0072-coredumps-restricted - Core Dumps Restricted¶
Rule ID¶
- 0072-coredumps-restricted
Category¶
- system
Level¶
- warn
Supported Versions¶
- Linux
Description¶
- A core dump is the memory of an executable program. It is typically used to determine why a program aborted. It can also be used to collect confidential information from the core file. The system provides the ability to set a soft limit for core dumps, but users can override this limit.
Scan Frequency¶
- 0 */30 * * *
Rationale¶
- Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups. Additionally, setting the
fs.suid_dumpablevariable to0prevents setuid programs from dumping core.
Risk Items¶
- Restricts users from overriding the soft variable
Audit Method¶
- Run the following commands and verify that the output matches:
# grep -E "^\s*\*\s+hard\s+core" /etc/security/limits.conf /etc/security/limits.d/*
* hard core 0
# sysctl fs.suid_dumpable
fs.suid_dumpable = 0
# grep "fs\.suid_dumpable" /etc/sysctl.conf /etc/sysctl.d/*
fs.suid_dumpable = 0
Run the following command to check if systemd-coredump is installed:
If it returns enabled or disabled, systemd-coredump is installed.
Remediation¶
- Add the following line to
/etc/security/limits.confor/etc/security/limits.d/*files:
Set the following parameter in /etc/sysctl.conf or /etc/sysctl.d/* files:
Run the following command to set the active kernel parameter:
If systemd-coredump is installed:
Edit /etc/systemd/coredump.conf and add/modify the following lines:
Run the command:
Impact¶
- Setting a hard limit on core dumps prevents users from overriding the soft variable.
Default Value¶
- By default, there is no configuration.
References¶
- None
CIS Controls¶
- Version 7
5.1 Establish Secure Configurations
Maintain documented, standard security configuration standards for all authorized operating systems and software.