cis-ubuntu1804-v220-1-5-2

name	cis-ubuntu1804-v220-1-5-2
description	Ensure core dumps are restricted
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","core-dumps","process-hardening","security"]
cis_id	1.5.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.5.2 Ensure core dumps are restricted (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user.

Rationale

Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5)). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core.

Audit Procedure

Command Line

Run the following command and verify output matches:

grep -Es '^(\*|\s).*hard.*core.*(\s+#.*)?$' /etc/security/limits.conf /etc/security/limits.d/*

Run the following script to verify fs.suid_dumpable = 0:

#!/usr/bin/env bash
{
    l_output="" l_output2=""
    a_parlist=("fs.suid_dumpable=0")
    l_ufwscf="$([ -f /etc/default/ufw ] && awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
    a_searchpath=("/run/sysctl.d/" "/etc/sysctl.d/" "/usr/local/lib/sysctl.d/" "/usr/lib/sysctl.d/" "/lib/sysctl.d/")
    unset A_files
    declare -A A_files
    A_files+=(["sysctl.conf"]="/etc/sysctl.conf")
    for l_searchpath in "${a_searchpath[@]}"; do
        if [ -d "$l_searchpath" ]; then
            while IFS= read -r -d $ l_filename; 
                 [ -f  ]; 
                    l_basename=
                     [ -z  ]; 
                        A_files+=([]=)
                    
                
             < <(find  - f -name  -print0)
        
    
    a_sorted=()
     IFS=  -rd  l_key; 
        a_sorted+=(  )
     < <(   |  -rz)
    ()
    {
        l_var= l_var2=
        l_krp=
         [  =  ]; 
            l_output=
        
            l_output2=
        
    }
     IFS=  -r l_kpname l_kpvalue; 
        l_kpname=; l_kpvalue=
        kernel_parameter_chk
     < <(  )
     A_files;  a_sorted
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}