[rpms/systemd] rawhide: Drop 20-yama-ptrace.conf

[rpms/systemd] rawhide: Drop 20-yama-ptrace.conf

[@ 2026-07-17 10:23 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/systemd
            Branch : rawhide
            Commit : ec1593fa55dcdc10067d24372d715855fb02cad9
            Author : Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com>
            Date   : 2026-07-17T11:39:26+02:00
            Stats  : +0/-47 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/systemd/c/ec1593fa55dcdc10067d24372d715855fb02cad9?branch=rawhide

            Log:
            Drop 20-yama-ptrace.conf

20-yama-ptrace.conf has the same (non-comment) content as
/usr/lib/sysctl.d/10-default-yama-scope.conf provided by
elfutils-default-yama-scope. We can drop our file.
And the new 99-kernel-hardening.conf provides a suitable replacement.

---
diff --git a/20-yama-ptrace.conf b/20-yama-ptrace.conf
deleted file mode 100644
index 4fbaf97..0000000
--- a/20-yama-ptrace.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-# The ptrace system call is used for interprocess services,
-# communication and introspection (like synchronisation, signaling,
-# debugging, tracing and profiling) of processes.
-#
-# Usage of ptrace is restricted by normal user permissions. Normal
-# unprivileged processes cannot use ptrace on processes that they
-# cannot send signals to or processes that are running set-uid or
-# set-gid. Nevertheless, processes running under the same uid will
-# usually be able to ptrace one another.
-#
-# Fedora enables the Yama security mechanism which restricts ptrace
-# even further. Sysctl setting kernel.yama.ptrace_scope can have one
-# of the following values:
-#
-# 0 - Normal ptrace security permissions.
-# 1 - Restricted ptrace. Only child processes plus normal permissions.
-# 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE.
-# 3 - No attach. No process may call ptrace at all. Irrevocable.
-#
-# For more information see Documentation/security/Yama.txt in the
-# kernel sources.
-#
-# The default is 1., which allows tracing of child processes, but
-# forbids tracing of arbitrary processes. This allows programs like
-# gdb or strace to work when the most common way of having the
-# debugger start the debuggee is used:
-#    gdb /path/to/program ...
-# Attaching to already running programs is NOT allowed:
-#    gdb -p ...
-# This default setting is suitable for the common case, because it
-# reduces the risk that one hacked process can be used to attack other
-# processes. (For example, a hacked firefox process in a user session
-# will not be able to ptrace the keyring process and extract passwords
-# stored only in memory.)
-#
-# Developers and administrators might want to disable those protections
-# to be able to attach debuggers to existing processes. Use
-#   sysctl kernel.yama.ptrace_scope=0
-# for change the setting temporarily, or copy this file to
-# /etc/sysctl.d/20-yama-ptrace.conf to set it for future boots.
-
-kernel.yama.ptrace_scope = 0

diff --git a/systemd.spec b/systemd.spec
index f11b19d..2d81fcd 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -119,7 +119,6 @@ Source6:        inittab
 Source7:        sysctl.conf.README
 Source8:        systemd-journal-remote.xml
 Source9:        systemd-journal-gatewayd.xml
-Source10:       20-yama-ptrace.conf
 Source11:       systemd-udev-trigger-no-reload.conf
 # https://fedoraproject.org/wiki/How_to_filter_libabigail_reports
 Source13:       libabigail.abignore
@@ -1137,10 +1136,6 @@ EOF
 
 install -Dm0644 -t %{buildroot}/usr/lib/firewalld/services/ %{SOURCE8} %{SOURCE9}
 
-# Install additional docs
-# https://bugzilla.redhat.com/show_bug.cgi?id=1234951
-install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE10}
-
 # Install kernel hardening file. Disabled by default.
 install -Dm0644 -t %{buildroot}%{_pkgdocdir}/ %{SOURCE19}