Cis Ubuntu2004 V300 1 5 3

1.5.3 Ensure core dumps are restricted (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user.

Rationale

Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5)). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core.

Audit Procedure

Command Line

Run the following command and verify output matches:

# grep -Ps -- '^\h*\*\h+hard\h+core\h+0\b' /etc/security/limits.conf /etc/security/limits.d/*

* hard core 0

Run the following script to verify fs.suid_dumpable = 0:

Run the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:

• fs.suid_dumpable is set to 0

Run the following command to check if systemd-coredump is installed:

# systemctl list-unit-files | grep coredump

If anything is returned systemd-coredump is installed.

• IF - systemd-coredump is installed, then run the following command and verify output matches:

# grep -Psi -- '^\s*Storage\s*=\s*none\s*$' /etc/systemd/coredump.conf

Storage=none

# grep -Psi -- '^\s*ProcessSizeMax\s*=\s*0' /etc/systemd/coredump.conf

ProcessSizeMax=0

Expected Result

• * hard core 0 should be set in limits.conf
• fs.suid_dumpable should be set to 0
• If systemd-coredump is installed, Storage=none and ProcessSizeMax=0 should be set

Remediation

Command Line

Add the following line to /etc/security/limits.conf or a /etc/security/limits.d/* file:

* hard core 0

Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf:

• fs.suid_dumpable = 0

Example:

# printf "\n%s" "fs.suid_dumpable = 0" >> /etc/sysctl.d/60-fs_sysctl.conf

Run the following command to set the active kernel parameter:

# sysctl -w fs.suid_dumpable=0

Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten.

• IF - systemd-coredump is installed: edit /etc/systemd/coredump.conf and add/modify the following lines:

Storage=none
ProcessSizeMax=0

Run the command:

systemctl daemon-reload

References

1. NIST SP 800-53 Rev. 5: CM-6

MITRE ATT&CK Mappings: T1005, T1005.000 | TA0007 | M1057