Uninstall Automatic Bug Reporting Tool (abrt)
Removes the base abrt package, disabling the Automatic Bug Reporting Tool and its crash-data collection.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
ABRT (Automatic Bug Reporting Tool) automatically collects application crash data and can forward it to remote services. Mishandled crash data can expose sensitive information, software vulnerabilities, plus secrets held in a process's address space or registers (passwords, keys, tokens). ABRT has also had its own privilege-escalation CVEs. On a hardened server it is unnecessary, and removing the base abrt package neutralizes the whole crash-collection stack.
What Pavois checks
Pavois queries the effective package database via the package('abrt') resource (rpm -q), which reflects what is truly installed and running now rather than any config file or vendor manifest, the live RPM database is the ground truth.
describe package('abrt') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q abrt. Expected output: package abrt is not installed. A version string means the rule fails. Confirm the daemon is gone with systemctl status abrtd (should report not-found).
Inspect & investigate
Confirm with rpm -q abrt; the removal is recorded in dnf history and /var/log/dnf.rpm.log. While installed, ABRT activity appears in journalctl -u abrtd and crash spools under /var/spool/abrt.
Remediation
Pavois's harden plan uses the package resource with action remove to uninstall abrt (equivalent to dnf remove abrt). Apply it with pavois harden apply. Removing the base package typically pulls the dependent ABRT addons with it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | abrt |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing abrt stops automatic crash collection and reporting, a clear security gain on servers. Precautions: if your operations team relies on ABRT to diagnose production crashes, set up an alternative first (e.g. systemd-coredump with restricted permissions, or kdump for the kernel). Removal stops and uninstalls the abrtd service but causes no application downtime, and the package can be reinstalled if needed.