Bug 2461722 - ltrace: add Recommends: yama-ptrace-enable for FESCo Change #3569
Summary: ltrace: add Recommends: yama-ptrace-enable for FESCo Change #3569
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: ltrace
Version: 45
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Carlos O'Donell
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 2448388
TreeView+ depends on / blocked
 
Reported: 2026-04-24 20:42 UTC by Aaron Merey
Modified: 2026-09-18 13:20 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-4865 0 None None None 2026-09-18 13:20:28 UTC

Description Aaron Merey 2026-04-24 20:42:22 UTC
Request packaging change for the ltrace side of FESCo Change
"Restrict ptrace by default" (fesco#3569, tracker rhbz#2448388).

elfutils ships a subpackage elfutils-default-yama-scope
whose sysctl file sets kernel.yama.ptrace_scope=0, disabling
yama's non-child ptrace restrictions. Because elfutils-libs
hard-Required it and is pulled in transitively by systemd, every
Fedora system has run with yama disabled.

Starting with Fedora 45 elfutils-0.195-1, elfutils-default-yama-scope
is renamed to yama-ptrace-enable, the hard Requires on elfutils-libs
is dropped, and the sysctl is installed only on systems where a
debugger-type package explicitly pulls it in. Systems without such
a package will fall back to the kernel default (ptrace_scope=1, child-only).
                                                                    
Please add the following to the relevant spec file for fedora >= 45:

  Recommends: yama-ptrace-enable

Recommends (not Requires) lets hardened environments opt out.

FESCo Change:  https://fedoraproject.org/wiki/Changes/Restrict_ptrace_by_default
FESCo issue:   https://pagure.io/fesco/issue/3569
Tracker bug:   https://bugzilla.redhat.com/show_bug.cgi?id=2448388

Reproducible: Always

Comment 1 Aoife Moloney 2026-08-17 14:35:52 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.


Note You need to log in before you can comment on or make changes to this bug.