Fedora 45 Debugging: Check Yama Before Chasing an Attach Error

Starting a program inside a debugger and attaching to one that is already running can take different paths on Fedora 45. The November 3 release restricts unprivileged process tracing by default. A developer seeing an attach failure should check that policy and the installed debugging packages before changing the application being investigated.

The release announcement confirms the default change. Fedora's accepted change document explains its boundary: Yama permits tracing of child processes while restricting attachment to another preexisting process, even when both belong to the same user. Processing core files and producing core dumps are unaffected by that mode. Root is also outside this particular restriction.

Why two Fedora machines may behave differently

Fedora's compromise depends on the software installed. Machines without debugger-type tools receive the restricted default. Installing packages that need the traditional attachment behaviour restores it through a sysctl file. The resulting setting applies system-wide, so the package selection matters beyond a single debugging session.

The change document names tools including gdb, lldb, strace, ltrace, delve, systemtap and elfutils in its dependency plan. It specifically excludes gdb-headless and gdb-minimal from the recommendation because their usual ABRT and build-system uses do not need that attachment behaviour. Finding a GDB-related package on a computer therefore needs a little more precision than searching for the word gdb.

This also explains why an upgraded development workstation and a fresh installation may differ. A machine already carrying the relevant tools can retain the enabling configuration, while a system without them follows the restricted default. Record the installed package names when comparing the two.

Read the setting before attempting a remedy

Fedora's documented check is sysctl -a | grep yama. Its test plan expects kernel.yama.ptrace_scope = 1 on the default installation and a value of 0 after the relevant enabling package is installed. Reading that output establishes the policy currently in force; it does not by itself diagnose every debugger error.

Keep the failed command and its message, then establish whether the target was started by the tool or was already running. Compare those details with the Yama setting. That is a more useful report than saying that tracing stopped after the upgrade.

Hand-built tools deserve particular attention

Fedora identifies manually compiled, script-based and differently packaged debugging tools as cases where users may notice the change. Such a tool may not bring in the package dependency that normally restores attachment. The change documentation names yama-ptrace-enable for the traditional behaviour, but that is a system-wide policy choice to review with the machine's administrator.

The security purpose is to limit a compromised process's ability to inspect the user's other processes and their data. Keep that purpose in view when deciding what a debugging machine needs. Our Fedora startup-report guide covers boot and dual-boot checks; this is a separate check after login, when the development tools begin doing their work.