mediumsystemverified ✓rollback-safe
Disable systemd-coredump socket
coredump-socket-disabled · RHEL ≥ 8 · 1 impl
Description
The systemd-coredump.socket must be masked to prevent the system from acquiring, saving, and processing core dumps through systemd.
Rationale
Even with core dump storage disabled, the systemd-coredump socket can still acquire and process core dumps. Masking the socket prevents any core dump collection through systemd.
Check → Remediate
Checkcommand
systemctl is-enabled systemd-coredump.socket 2>/dev/null | grep -qx masked
- expected_exit:
- 0
Remediateservice_masked
- name:
- systemd-coredump.socket
Framework references
STIG
V-230312V-281320 / RHEL-10-701180V-257815 / RHEL-09-213100
NIST 800-53
SC-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#coredump#systemd#security