Bug 2461722 - ltrace: add Recommends: yama-ptrace-enable for FESCo Change #3569
Summary: ltrace: add Recommends: yama-ptrace-enable for FESCo Change #3569
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: ltrace
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Carlos O'Donell
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2448388
TreeView+ depends on / blocked
 
Reported: 2026-04-24 20:42 UTC by Aaron Merey
Modified: 2026-04-24 20:42 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Aaron Merey 2026-04-24 20:42:22 UTC
Request packaging change for the ltrace side of FESCo Change
"Restrict ptrace by default" (fesco#3569, tracker rhbz#2448388).

elfutils ships a subpackage elfutils-default-yama-scope
whose sysctl file sets kernel.yama.ptrace_scope=0, disabling
yama's non-child ptrace restrictions. Because elfutils-libs
hard-Required it and is pulled in transitively by systemd, every
Fedora system has run with yama disabled.

Starting with Fedora 45 elfutils-0.195-1, elfutils-default-yama-scope
is renamed to yama-ptrace-enable, the hard Requires on elfutils-libs
is dropped, and the sysctl is installed only on systems where a
debugger-type package explicitly pulls it in. Systems without such
a package will fall back to the kernel default (ptrace_scope=1, child-only).
                                                                    
Please add the following to the relevant spec file for fedora >= 45:

  Recommends: yama-ptrace-enable

Recommends (not Requires) lets hardened environments opt out.

FESCo Change:  https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default
FESCo issue:   https://pagure.io/fesco/issue/3569
Tracker bug:   https://bugzilla.redhat.com/show_bug.cgi?id=2448388

Reproducible: Always


Note You need to log in before you can comment on or make changes to this bug.