1.4.1 Ensure core dumps are restricted - sysctl


A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user.


Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5) ). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core.


Add the following line to /etc/security/limits.conf or a /etc/security/limits.d/* file:

* hard core 0

Run the following command to set the active kernel parameter:

# sysctl -w fs.suid_dumpable=0

If systemd-coredump@ is installed:
edit /etc/systemd/coredump.conf and add/modify the following lines:


Run the command:

systemctl daemon-reload

/etc is stateless on Container-Optimized OS. Therefore, /etc cannot be used to make these changes persistent across reboots. The steps mentioned above needs to be performed after every boot.

See Also


Item Details


References: 800-53|CM-6, CSCv7|5.1

Plugin: Unix

Control ID: 6e7d1c31dbd64ff3c1f6cb8a436cb9cb0b4203c85623c85afbb5ee4db8d88541