mediumsystemverified ✓rollback-safe
Disable core dumps for SUID programs
coredump-suid-disabled · RHEL ≥ 8 · 1 impl
Description
Core dumps for SUID programs should be disabled via the fs.suid_dumpable sysctl parameter.
Rationale
SUID programs run with elevated privileges and their memory may contain sensitive data. Preventing core dumps from these programs protects privileged information from being written to disk.
Check → Remediate
Checksysctl_value
- key:
- fs.suid_dumpable
- expected:
- 0
Remediatesysctl_set
- key:
- fs.suid_dumpable
- value:
- 0
Framework references
CIS
rhel8 1.5.4rhel9 1.5.2rhel10 1.5.4
NIST 800-53
SC-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#coredump#suid#security#sysctl