ptrace_scope is a sysctl value (/proc/sys/kernel/yama/ptrace_scope) that prevents the use of ptrace on non-child processes when set to 1. This is generally considered good security practice.
Unfortunately, being able to ptrace a process as a developer (and attach to a running process, so not a child process) is very useful. Using sudo with the CAP_SYS_PTRACE capability allows one to attach to any running process, not just processes owned by the user. On a shared dev box, it might not be desirable to allow ptrace via sudo for all processes, as that essentially allows arbitrary code to be run as any user.
What I would like to do is allow a user to sudo (or otherwise require authentication) to ptrace a non-child process, but not to allow them to ptrace arbitrary processes. Essentially allowing them to change ptrace_scope for themselves on a temporary, authentication guarded basis.
Is this possible?
