Uninstall abrt-addon-ccpp Package
Removes the abrt-addon-ccpp package so C/C++ crash dumps (which may leak process memory) are not collected.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
abrt-addon-ccpp installs hooks for crashed C/C++ programs plus ABRT's C/C++ analyzer plugin. By capturing core dumps it can write the memory contents of a crashing process, potentially passwords, keys or other secrets held in registers and address space, to disk and even forward them off-host. On a hardened server this crash-collection machinery is unnecessary and best removed.
What Pavois checks
Pavois queries the effective package database via the package('abrt-addon-ccpp') resource (rpm -q), which reflects what is truly installed and active right now, not a config file or a vendor manifest. This catches the package even if a disabled repo or a stray drop-in left a reference behind.
describe package('abrt-addon-ccpp') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q abrt-addon-ccpp. Expected output: package abrt-addon-ccpp is not installed. Any version string means the rule fails.
Inspect & investigate
Confirm absence with rpm -q abrt-addon-ccpp; the removal transaction is recorded in dnf history and /var/log/dnf.rpm.log. While present, its activity surfaces in the ABRT logs and journalctl -u abrtd.
Remediation
Pavois's harden plan uses the package resource with action remove to uninstall abrt-addon-ccpp (equivalent to dnf remove abrt-addon-ccpp). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | abrt-addon-ccpp |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing this addon means C/C++ application crashes are no longer auto-captured by ABRT, a deliberate trade-off favoring confidentiality over diagnostics. Precautions: if a team relies on ABRT for production debugging, confirm an alternative (e.g. systemd-coredump with restricted access) before removing. Removal is non-disruptive: no service interruption, and the package can be reinstalled if needed.