…nd ptrace

Receiving any of these signals or starting to ptrace the process leads
to a system hang.
This hardening module prevents such thing to happen.

Without the module (example for ptrace):
~~~
$ sesearch -A -t fapolicyd_t -c process -p ptrace
allow abrt_dump_oops_t domain:process ptrace; [ deny_ptrace ]:False
allow sysadm_t domain:process ptrace; [ deny_ptrace ]:False
allow unconfined_domain_type domain:process ptrace; [ deny_ptrace ]:False
~~~

With the module:
~~~
$ sesearch -A -t fapolicyd_t -c process -p ptrace
--> no rule

$ strace -fttTvyy -p $(pgrep fapolicyd)
strace: attach: ptrace(PTRACE_SEIZE, 3930): Permission denied
~~~

Note: requires policycoreutils >= -3.6-0.rc2.1 ("deny" functionality)

Signed-off-by: Renaud Métrich <[email protected]>

Signed-off-by: Renaud Métrich <[email protected]>