Bug 2461598

Summary: gdb: migrate default-yama-scope dependency to yama-ptrace-enable for FESCo Change #3569
Product: [Fedora] Fedora Reporter: Aaron Merey <amerey>
Component: gdbAssignee: Kevin Buettner <kevinb>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 45CC: ahajkova, fche, fweimer, guinevere, jan, keiths, kevinb, mcermak, mkolar, suraj.ghimire7
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2448388    

Description Aaron Merey 2026-04-24 17:49:53 UTC
Request packaging change for the gdb side of FESCo Change "Restrict
ptrace by default" (fesco#3569, tracker rhbz#2448388).

elfutils has historically shipped a subpackage (elfutils-default-
yama-scope) whose sysctl file sets kernel.yama.ptrace_scope=0,
disabling yama's non-child ptrace restrictions. Because elfutils-
libs hard-Required it and is pulled in transitively by systemd,
every Fedora system has run with yama disabled.

Starting with Fedora 45 elfutils-0.195-1, that subpackage is renamed to
yama-ptrace-enable, the hard Requires on elfutils-libs is dropped,
and the sysctl is installed only on systems where a debugger-type
package explicitly pulls it in. Systems without such a package
will fall back to the kernel default (ptrace_scope=1, child-only).

gdb is a special case: `dnf repoquery --whatdepends default-yama-scope`
shows gdb-headless (not the main gdb subpackage) as the declared
consumer today. The FESCo proposal explicitly excludes gdb-headless
and gdb-minimal from the new Recommends, since their consumers
(ABRT, rpmbuild) don't need non-child ptrace. The Recommends belongs
on the user-facing gdb subpackage instead.

Please make two changes on rawhide:

1. Remove from gdb-headless (and gdb-minimal, if it has it):
  Recommends: default-yama-scope

2. Add to the main user-facing gdb subpackage:
  Recommends: yama-ptrace-enable

FESCo Change:  https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default
FESCo issue:   https://pagure.io/fesco/issue/3569
Tracker bug:   https://bugzilla.redhat.com/show_bug.cgi?id=2448388

Comment 1 Frank Ch. Eigler 2026-07-13 18:36:47 UTC
NB: Fedora 45 testing/rebuilding processes are getting started soon.
It would be great to have this one-line .spec change active sooner rather than later so that composes pull in what's needed.  Elfutils has already switched over.

Comment 2 Aoife Moloney 2026-08-17 14:35:49 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.