Bug 2461434 - elfutils: restrict ptrace by default per FESCo Change #3569
Summary: elfutils: restrict ptrace by default per FESCo Change #3569
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: elfutils
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Aaron Merey
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2448388
TreeView+ depends on / blocked
 
Reported: 2026-04-24 14:44 UTC by Aaron Merey
Modified: 2026-04-28 16:46 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-04-28 16:46:12 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 2448388 0 unspecified CLOSED Changes/Restrict ptrace by default 2026-04-25 21:41:56 UTC

Description Aaron Merey 2026-04-24 14:44:50 UTC
elfutils currently ships a subpackage, elfutils-default-yama-scope,                                                                       
whose sole content is a sysctl file that sets                                                                                             
kernel.yama.ptrace_scope=0 (disabling yama's non-child ptrace
restrictions). elfutils-libs hard-Requires this subpackage, and                                                                           
because elfutils-libs is pulled in transitively by systemd, every                                                                         
Fedora system ends up with yama disabled today.                                                                                           
                                                                                                                                            
Starting with Fedora 45 elfutils-0.195-1:                                                                                                           
  - elfutils-default-yama-scope is renamed to yama-ptrace-enable.                                                                         
  - elfutils-libs no longer Requires it; the old subpackage is   
    Obsoleted to clean up on upgrade.                                                                                                     
  - The main elfutils package gains Recommends: yama-ptrace-enable,                                                                       
    and separate bugs are being filed against other debugger-type                                                                         
    packages (gdb, strace, systemtap, etc.) to do the same.                                                                               
                                                                                                                                            
Net effect: systems without any debugger-type package installed
will run with yama's kernel default (ptrace_scope=1, child-only).                                                                         
Systems with a debugger installed keep full non-child ptrace     
functionality via the Recommends.     

FESCo Change:  https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default
FESCo issue:   https://pagure.io/fesco/issue/3569
Tracker bug:   https://bugzilla.redhat.com/show_bug.cgi?id=2448388

Comment 1 Mark Wielaard 2026-04-24 14:56:26 UTC
(In reply to Aaron Merey from comment #0)
> Starting with Fedora 45 elfutils-0.195-1:                                   
> 
>   - elfutils-default-yama-scope is renamed to yama-ptrace-enable.           

The elfutils-default-yama-scope package Provides default-yama-scope.
default-yama-scope is what other packages Require or Recommend.
Do we really need to rename that? The name doesn't change what it does
and it seems unnecessary make work.

Rest is fine of course.

Comment 2 Frank Ch. Eigler 2026-04-24 15:43:59 UTC
The name was chosen to communicate intent/outcome, not just subject matter.


Note You need to log in before you can comment on or make changes to this bug.