Uninstall abrt-addon-kerneloops Package
Removes the abrt-addon-kerneloops package so kernel oops data is not collected and reported to a remote server.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
abrt-addon-kerneloops collects kernel crash (oops) information and ships a reporter plugin that sends it to a remote server (typically kerneloops.org). Automatically transmitting kernel state off-host can leak sensitive details about the system and its vulnerabilities, and is unnecessary on a hardened server, so the package should be removed.
What Pavois checks
Pavois queries the effective package database via the package('abrt-addon-kerneloops') resource (rpm -q), reflecting what is actually installed now rather than any config or manifest. The live RPM database is the ground truth for whether the reporter is present.
describe package('abrt-addon-kerneloops') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q abrt-addon-kerneloops. Expected output: package abrt-addon-kerneloops is not installed. A version string means the rule fails.
Inspect & investigate
Confirm with rpm -q abrt-addon-kerneloops; the removal is logged in dnf history and /var/log/dnf.rpm.log. Reporting activity, while installed, appears in journalctl -u abrtd and the ABRT logs under /var/spool/abrt.
Remediation
Pavois's harden plan uses the package resource with action remove to uninstall abrt-addon-kerneloops (equivalent to dnf remove abrt-addon-kerneloops). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | abrt-addon-kerneloops |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
After removal, kernel oops events are no longer auto-reported off-host, generally desirable on hardened systems. Precautions: if you intentionally use kerneloops telemetry, ensure another mechanism captures kernel issues (e.g. kdump) before removing. Removal causes no service interruption and is reversible by reinstalling the package.