Detections
Analytics

1.5.8 Ensure core file size is configured

Information

This recommendation enforces a hard limit of 0 on the core file size for all users through /etc/security/limits.conf (or a file in /etc/security/limits.d/ ), preventing users from raising the limit and generating core dumps.

 - core - limits the size of core files that may be created.
 - hard - a hard resource limit; set by the superuser and enforced by the kernel. A user cannot raise their resource limit above a hard value.

Setting a hard limit on core dumps prevents users from overriding the soft variable.

A core dump includes a memory image taken at the time the operating system terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.

Solution

- Run the following command to comment out any entries that include a hard value for core greater than 0 in /etc/security/limits.conf and any file(s) in the /etc/security/limits.d/ directory.

Example:

# sed -ri '/^\s*[^#\n\r]+\s+hard\s+core\s+([1-9][0-9]*)/s/^/# /' /etc/security/limits.conf /etc/security/limits.d/*

 - Create or edit a file in /etc/security/limits.d/ and add the following line:

* hard core 0

Example:

# printf '%s\n' "" "* hard core 0" >> /etc/security/limits.d/60-limits.conf

Impact:

Users and processes will be unable to generate core dumps (a hard core limit of 0 ), which may hinder debugging of applications that crash.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Unix

Control ID: 61ee97292b60ae5fc2b37566a5a10fcf5bb3a5ddfd3716276c4062c8308b8088