Fedora Account System
Red Hat Associate
Red Hat Customer
Request packaging change for the gdb side of FESCo Change "Restrict ptrace by default" (fesco#3569, tracker rhbz#2448388). elfutils has historically shipped a subpackage (elfutils-default- yama-scope) whose sysctl file sets kernel.yama.ptrace_scope=0, disabling yama's non-child ptrace restrictions. Because elfutils- libs hard-Required it and is pulled in transitively by systemd, every Fedora system has run with yama disabled. Starting with Fedora 45 elfutils-0.195-1, that subpackage is renamed to yama-ptrace-enable, the hard Requires on elfutils-libs is dropped, and the sysctl is installed only on systems where a debugger-type package explicitly pulls it in. Systems without such a package will fall back to the kernel default (ptrace_scope=1, child-only). gdb is a special case: `dnf repoquery --whatdepends default-yama-scope` shows gdb-headless (not the main gdb subpackage) as the declared consumer today. The FESCo proposal explicitly excludes gdb-headless and gdb-minimal from the new Recommends, since their consumers (ABRT, rpmbuild) don't need non-child ptrace. The Recommends belongs on the user-facing gdb subpackage instead. Please make two changes on rawhide: 1. Remove from gdb-headless (and gdb-minimal, if it has it): Recommends: default-yama-scope 2. Add to the main user-facing gdb subpackage: Recommends: yama-ptrace-enable FESCo Change: https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default FESCo issue: https://pagure.io/fesco/issue/3569 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2448388
NB: Fedora 45 testing/rebuilding processes are getting started soon. It would be great to have this one-line .spec change active sooner rather than later so that composes pull in what's needed. Elfutils has already switched over.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.