Uninstall abrt-plugin-sosreport Package
Removes the abrt-plugin-sosreport package so full system diagnostics are not bundled into ABRT crash reports.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
abrt-plugin-sosreport lets ABRT attach a full sosreport to a crash report. An sosreport is a sweeping system diagnostic bundle (configuration, logs, network, package state), embedding it in crash data dramatically widens what can leak if a report is exfiltrated or sent off-host. On a hardened server this plugin is unnecessary and should be removed.
What Pavois checks
Pavois queries the effective package database via the package('abrt-plugin-sosreport') resource (rpm -q), reporting what is actually installed now rather than any config or manifest, the live RPM database is authoritative.
describe package('abrt-plugin-sosreport') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q abrt-plugin-sosreport. Expected output: package abrt-plugin-sosreport is not installed. A version string means the rule fails.
Inspect & investigate
Confirm with rpm -q abrt-plugin-sosreport; the removal is logged in dnf history and /var/log/dnf.rpm.log.
Remediation
Pavois's harden plan uses the package resource with action remove to uninstall abrt-plugin-sosreport (equivalent to dnf remove abrt-plugin-sosreport). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | abrt-plugin-sosreport |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing this plugin only stops ABRT from auto-attaching sosreports; the standalone sos tool (if installed) still works for on-demand diagnostics. Precautions: none significant, no service interruption, and reinstalling the package restores the behaviour. Keep the standalone sos package if support cases require sosreports.