On Sun, Apr 08, 2012 at 07:02:31PM +0200, Mark Wielaard wrote:
Previously
https://fedoraproject.org/wiki/Features/SELinuxDenyPtrace
implied that this feature could be turned on by an administrator,
but recently it was changed to be on by default. Was that intended?
The change to selinux-policy was fairly recent (3.10.0-92) and seems
to have taken at least some people by surprise.
Fesco approved this feature with the understanding that it would be
disabled by default. While some degree of scope creep is fairly common
in the feature process, the feature as it exists now seems pretty
different to what we approved.
--
Matthew Garrett | mjg59(a)srcf.ucam.org