Uninstall abrt-cli Package
Removes the abrt-cli package so the command-line client for the ABRT crash daemon is no longer present.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
abrt-cli provides a command-line client that controls the ABRT daemon over its sockets, giving local access to collected crash reports. Those reports can contain sensitive process memory (passwords, keys). On a hardened server the crash-reporting subsystem is unwanted, and removing its client tooling reduces both the attack surface and the exposure of captured crash data.
What Pavois checks
Pavois queries the effective package database via the package('abrt-cli') resource (rpm -q), which reports what is actually installed now, the authoritative source rather than any config or vendor list.
describe package('abrt-cli') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q abrt-cli. Expected output: package abrt-cli is not installed. A version string means the rule fails.
Inspect & investigate
Confirm with rpm -q abrt-cli; the removal transaction is recorded in dnf history and /var/log/dnf.rpm.log.
Remediation
Pavois's harden plan uses the package resource with action remove to uninstall abrt-cli (equivalent to dnf remove abrt-cli). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | abrt-cli |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing abrt-cli only takes away the command-line interface to ABRT; it does not disrupt running services. Precautions: if operators use abrt-cli to triage crashes, plan to remove the wider ABRT stack (abrt, addons) together so the workflow is consistent. The change is reversible by reinstalling the package.