Hi,

ltrace is checking if the deny_ptrace SELinux boolean is enable and
print a warning if it's the case.

It's important to note that this boolean is RHEL/Fedora specific,
distributions (like Debian/Ubuntu, gentoo,...) that are using the
refpolicy doesn't have it. They have a "allow_ptrace" boolean instead
(the logic is reversed).

I guess that this should be tested too?

But note that these booleans are only present in implementation of the
SELinux policy and not part of SELinux itself. That means that one could
write a policy where these booleans are not existing at all, it might
even be a better idea to always print the warning if ptrace is failing
with errno==EPERM and if selinux is enabled. The message could still
mention the these usual booleans (deny_ptrace and allow_ptrace) as they
are used on a lot of machines.

Cheers,

Laurent Bigonville