Uninstall libreport-plugin-logger Package
Ensures the ABRT libreport-plugin-logger crash-reporting plugin is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
libreport-plugin-logger is an ABRT (Automatic Bug Reporting Tool) plugin that writes crash reports to a log. ABRT and its plugins automatically collect and forward crash data, which can leak sensitive information (memory contents, configuration) off-host and adds unnecessary code that runs on faults. On hardened systems ABRT is disabled, so its plugins should be removed to reduce the attack surface.
What Pavois checks
Pavois queries the package database via InSpec package('libreport-plugin-logger') (rpm -q libreport-plugin-logger) and asserts it is not installed. The live RPM database is authoritative, it confirms the plugin is truly gone, not merely disabled in ABRT configuration.
describe package('libreport-plugin-logger') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q libreport-plugin-logger. The expected output is package libreport-plugin-logger is not installed. A version line means the rule fails.
Inspect & investigate
Confirm removal via dnf history or rpm -q --last libreport-plugin-logger; /var/log/dnf.rpm.log records the uninstall transaction. ABRT activity, if any remains, is logged under /var/log/abrt/ and via journalctl -u abrtd.
Remediation
Pavois's harden plan declares a package resource named libreport-plugin-logger with action remove; pavois harden apply runs the equivalent of dnf remove libreport-plugin-logger to reach the compliant state. If remediation were empty you would uninstall it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | libreport-plugin-logger |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing this ABRT plugin disables logger-based crash reporting only; core system operation is unaffected. Precaution: if your organization actually relies on ABRT to capture crash data for diagnostics, removing the plugin will stop that collection. Confirm ABRT is not part of your supported troubleshooting workflow before applying; removal may pull in other libreport/abrt dependencies, so review the dnf remove plan.