cis-ubuntu2004-v300-1-5-3

name	cis-ubuntu2004-v300-1-5-3
description	Ensure core dumps are restricted
category	cis-storage
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","core-dumps","hardening","sysctl"]
cis_id	1.5.3
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.5.3 Ensure core dumps are restricted (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user.

Rationale

Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5)). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core.

Audit Procedure

Command Line

Run the following command and verify output matches:

# grep -Ps -- '^\h*\*\h+hard\h+core\h+0\b' /etc/security/limits.conf /etc/security/limits.d/*

* hard core 0

Run the following script to verify fs.suid_dumpable = 0:

Run the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:

• fs.suid_dumpable is set to 0

Run the following command to check if systemd-coredump is installed:

# systemctl list-unit-files | grep coredump

If anything is returned systemd-coredump is installed.

• IF - systemd-coredump is installed, then run the following command and verify output matches:

# grep -Psi -- '^\s*Storage\s*=\s*none\s*$' /etc/systemd/coredump.conf

Storage=none

# grep -Psi -- '^\s*ProcessSizeMax\s*=\s*0' /etc/systemd/coredump.conf

ProcessSizeMax=0

Expected Result

• * hard core 0 should be set in limits.conf
• fs.suid_dumpable should be set to 0
• If systemd-coredump is installed, Storage=none and should be set