Uninstall python3-abrt-addon Package
Ensures the python3-abrt-addon crash-reporting hook is not installed on the host.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
python3-abrt-addon provides the ABRT (Automatic Bug Reporting Tool) Python hook and analyzer that capture uncaught exceptions in Python programs. Automatic crash capture and reporting can collect sensitive data (memory contents, configuration, credentials present at crash time) and transmit it off-host, and ABRT has a history of local privilege-escalation vulnerabilities. On a hardened server it adds attack surface with no operational benefit, so it should be removed.
What Pavois checks
Pavois checks the effective package state with package('python3-abrt-addon') and expects it absent (should_not be_installed), resolved through rpm. Confirming the package is truly gone is stronger than checking whether ABRT is disabled in a config file, since a disabled-but-present addon can still be re-enabled or exploited.
describe package('python3-abrt-addon') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q python3-abrt-addon. Expected output: package python3-abrt-addon is not installed.
Inspect & investigate
Removal history is visible with dnf history and in /var/log/dnf.log. Past ABRT crash-capture activity would have appeared under /var/spool/abrt/ and in journalctl -u abrtd.
Remediation
Pavois's harden plan removes the python3-abrt-addon package via the package resource (action: remove). It is applied with pavois harden apply. Other ABRT components (abrt, abrt-cli, etc.) are handled by their own controls if present.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | python3-abrt-addon |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing this addon is low-risk on servers and only disables automatic capture of Python crash reports. - If your operations rely on ABRT to triage application crashes, ensure an alternative crash-collection mechanism is in place before removing it. - Removal may pull in dependency changes via dnf; review the transaction so an unintended package is not removed alongside it.