Detections
Analytics
1.5.3 Ensure fs.suid_dumpable is configured
Information
fs.suid_dumpable governs whether a privileged process (with the setuid bit) can generate a core dump, regardless of other configurations.fs.suid_dumpable values:
- 0 (default) - Any process that has changed privilege levels (like SUID programs) or is execute-only will not dump core.
- 1 (debug) - All processes dump core if possible. The core dump is owned by the current user and security is not applied. This is primarily intended for system debugging.
- 2 (suidsafe) - Any binary that normally wouldn't be dumped is dumped, but only if the core_pattern is set to a pipe handler or a fully qualified path. This mode is suitable for administrators debugging in a production environment.
More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.
Core dumps may contain sensitive in-memory data like password hashes or keys. An attacker could potentially exploit this to gain access to such data.
Solution
- Review all files being used by systemd sysctl and comment out or remove all fs.suid_dumpable lines that are not fs.suid_dumpable=0.Example script:
#!/usr/bin/env bash
{
l_option="fs.suid_dumpable" l_value="0"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*([1-9][0-9]*)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:
fs.suid_dumpable = 0
Example:
# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "fs.suid_dumpable = 0" >> /etc/sysctl.d/60-fs_sysctl.conf
- Run the following command to load all sysctl configuration files:
# sysctl --system
Impact:
Processes that have changed privilege levels (such as SUID programs) and execute-only binaries will not produce a core dump. This is the secure default; the only operational effect is that debugging of such programs via core files is limited.
See Also
Item Details
Audit Name: CIS Red Hat Enterprise Linux 9 v3.0.0 L1 Server
Category: ACCESS CONTROL
References: 800-53|AC-3(4)
Plugin: Unix
Control ID: 5782cbbf2a099f2c49d5f0bab8e0481b4d8b045af6a8b495525cc4c6b7d0e602