Fedora Account System
Red Hat Associate
Red Hat Customer
Request packaging change for the ltrace side of FESCo Change "Restrict ptrace by default" (fesco#3569, tracker rhbz#2448388). elfutils ships a subpackage elfutils-default-yama-scope whose sysctl file sets kernel.yama.ptrace_scope=0, disabling yama's non-child ptrace restrictions. Because elfutils-libs hard-Required it and is pulled in transitively by systemd, every Fedora system has run with yama disabled. Starting with Fedora 45 elfutils-0.195-1, elfutils-default-yama-scope is renamed to yama-ptrace-enable, the hard Requires on elfutils-libs is dropped, and the sysctl is installed only on systems where a debugger-type package explicitly pulls it in. Systems without such a package will fall back to the kernel default (ptrace_scope=1, child-only). Please add the following to the relevant spec file for fedora >= 45: Recommends: yama-ptrace-enable Recommends (not Requires) lets hardened environments opt out. FESCo Change: https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default FESCo issue: https://pagure.io/fesco/issue/3569 Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2448388 Reproducible: Always