diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm
index 64c3410baf4e48f0ce0dd33be74cd8ba49143d88..0c60355a1cebe08daa274cc50e1c0203dfaae05e 100644
--- a/gnu/build/activation.scm
+++ b/gnu/build/activation.scm
@@ -30,6 +30,7 @@ (define-module (gnu build activation)
             activate-/bin/sh
             activate-modprobe
             activate-firmware
+            activate-ptrace-attach
             activate-current-system))
 
 ;;; Commentary:
@@ -335,6 +336,18 @@ (define (activate-firmware directory)
     (lambda (port)
       (display directory port))))
 
+(define (activate-ptrace-attach)
+  "Allow users to PTRACE_ATTACH their own processes.
+
+This works around a regression introduced in the default \"security\" policy
+found in Linux 3.4 onward that prevents users from attaching to their own
+processes--see Yama.txt in the Linux source tree for the rationale.  This
+sounds like an unacceptable restriction for little or no security
+improvement."
+  (call-with-output-file "/proc/sys/kernel/yama/ptrace_scope"
+    (lambda (port)
+      (display 0 port))))
+
 
 (define %current-system
   ;; The system that is current (a symlink.)  This is not necessarily the same
diff --git a/gnu/system.scm b/gnu/system.scm
index a91c7136da259ef94e52a95a6e5b6c0e002ee27d..6cf12df604078237e16f0338c1ccb88b67b7e61a 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -681,6 +681,9 @@ (define group-specs
                     (activate-firmware
                      (string-append #$firmware "/lib/firmware"))
 
+                    ;; Let users debug their own processes!
+                    (activate-ptrace-attach)
+
                     ;; Run the services' activation snippets.
                     ;; TODO: Use 'load-compiled'.
                     (for-each primitive-load '#$actions)