Disable Core Dumps for All Users
Description
To disable core dumps for all users, add the following line to
/etc/security/limits.conf, or to a file within the
/etc/security/limits.d/ directory:
Rationale
A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data and is generally useful
only for developers trying to debug problems.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'libpam-runtime' 2>/dev/null | grep -q installed; then
SECURITY\_LIMITS\_FILE="/etc/security/limits.conf"
if grep -qE '^\s\*\\*\s+hard\s+core' $SECURITY\_LIMITS\_FILE; then
sed -ri 's/(hard\s+core\s+)[[:digit:]]+/\1 0/' $SECURITY\_LIMITS\_FILE
else
echo "\* hard core 0" >> $SECURITY\_LIMITS\_FILE
fi
if ls /etc/security/limits.d/\*.conf > /dev/null; then
sed -ri '/^\s\*\\*\s+hard\s+core/d' /etc/security/limits.d/\*.conf
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package\_facts:
manager: auto
tags:
- NIST-800-53-CM-6
- NIST-800-53-SC-7(10)
- PCI-DSSv4-3.3.1.1
- PCI-DSSv4-3.3.1.2
- PCI-DSSv4-3.3.1.3
- disable\_users\_coredumps
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- restrict\_strategy
- name: Disable core dumps with limits
lineinfile:
dest: /etc/security/limits.conf
regexp: ^[^#].\*core
line: '\* hard core 0'
create: true
when: '"libpam-runtime" in ansible\_facts.packages'
tags:
- NIST-800-53-CM-6
- NIST-800-53-SC-7(10)
- PCI-DSSv4-3.3.1.1
- PCI-DSSv4-3.3.1.2
- PCI-DSSv4-3.3.1.3
- disable\_users\_coredumps
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- restrict\_strategy
