Uninstall libreport-plugin-rhtsupport Package
Ensures the ABRT libreport-plugin-rhtsupport Red Hat Support reporting plugin is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
libreport-plugin-rhtsupport is an ABRT plugin that reports bugs into the Red Hat Support system. It automatically uploads crash data to an external service, which can leak sensitive information (memory contents, configuration, hostnames) off the host. On hardened systems ABRT is disabled, so this plugin should be removed to reduce the attack surface and prevent unintended data exfiltration.
What Pavois checks
Pavois queries the package database via InSpec package('libreport-plugin-rhtsupport') (rpm -q libreport-plugin-rhtsupport) and asserts it is not installed. The live RPM database is authoritative, it confirms the upload plugin is truly absent, not merely disabled in ABRT configuration.
describe package('libreport-plugin-rhtsupport') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q libreport-plugin-rhtsupport. The expected output is package libreport-plugin-rhtsupport is not installed. A version line means the rule fails.
Inspect & investigate
Confirm removal via dnf history or rpm -q --last libreport-plugin-rhtsupport; /var/log/dnf.rpm.log records the uninstall transaction. ABRT activity, if any remains, is logged under /var/log/abrt/ and via journalctl -u abrtd.
Remediation
Pavois's harden plan declares a package resource named libreport-plugin-rhtsupport with action remove; pavois harden apply runs the equivalent of dnf remove libreport-plugin-rhtsupport to reach the compliant state. If remediation were empty you would uninstall it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | libreport-plugin-rhtsupport |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing this plugin disables automatic bug reporting to Red Hat Support; core system operation is unaffected. Precaution: if your support process relies on submitting cases directly from the host via ABRT, removing the plugin will break that integration (you can still open cases through the Red Hat portal). Confirm this is not part of your supported workflow; removal may pull in other libreport/abrt dependencies, so review the dnf remove plan.