Bug 2461598 - gdb: migrate default-yama-scope dependency to yama-ptrace-enable for FESCo Change #3569
Summary: gdb: migrate default-yama-scope dependency to yama-ptrace-enable for FESCo Ch...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: gdb
Version: 45
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kevin Buettner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2448388
TreeView+ depends on / blocked
 
Reported: 2026-04-24 17:49 UTC by Aaron Merey
Modified: 2026-08-17 14:35 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Aaron Merey 2026-04-24 17:49:53 UTC
Request packaging change for the gdb side of FESCo Change "Restrict
ptrace by default" (fesco#3569, tracker rhbz#2448388).

elfutils has historically shipped a subpackage (elfutils-default-
yama-scope) whose sysctl file sets kernel.yama.ptrace_scope=0,
disabling yama's non-child ptrace restrictions. Because elfutils-
libs hard-Required it and is pulled in transitively by systemd,
every Fedora system has run with yama disabled.

Starting with Fedora 45 elfutils-0.195-1, that subpackage is renamed to
yama-ptrace-enable, the hard Requires on elfutils-libs is dropped,
and the sysctl is installed only on systems where a debugger-type
package explicitly pulls it in. Systems without such a package
will fall back to the kernel default (ptrace_scope=1, child-only).

gdb is a special case: `dnf repoquery --whatdepends default-yama-scope`
shows gdb-headless (not the main gdb subpackage) as the declared
consumer today. The FESCo proposal explicitly excludes gdb-headless
and gdb-minimal from the new Recommends, since their consumers
(ABRT, rpmbuild) don't need non-child ptrace. The Recommends belongs
on the user-facing gdb subpackage instead.

Please make two changes on rawhide:

1. Remove from gdb-headless (and gdb-minimal, if it has it):
  Recommends: default-yama-scope

2. Add to the main user-facing gdb subpackage:
  Recommends: yama-ptrace-enable

FESCo Change:  https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default
FESCo issue:   https://pagure.io/fesco/issue/3569
Tracker bug:   https://bugzilla.redhat.com/show_bug.cgi?id=2448388

Comment 1 Frank Ch. Eigler 2026-07-13 18:36:47 UTC
NB: Fedora 45 testing/rebuilding processes are getting started soon.
It would be great to have this one-line .spec change active sooner rather than later so that composes pull in what's needed.  Elfutils has already switched over.

Comment 2 Aoife Moloney 2026-08-17 14:35:49 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.


Note You need to log in before you can comment on or make changes to this bug.