# Ensure core dumps are restricted

Necessity: A core dump is a file containing the memory image of a process at the time it terminated unexpectedly. This file can contain sensitive data such as passwords, encryption keys, or proprietary information. If an attacker can induce a crash in a privileged application, they could potentially access this sensitive information from the core dump file, leading to data leakage or privilege escalation. Restricting core dumps is a critical hardening step to prevent this form of information disclosure.

Auditing and Remediation: The audit script verifies the system's configuration to ensure that the kernel is instructed not to create core dump files. It checks both the user resource limits in '/etc/security/limits.conf' and the kernel parameter 'fs.suid_dumpable'. The remediation script enforces this security control by modifying these configuration files to disable core dump generation system-wide and disables the systemd service responsible for processing them.

Recommended State Rationale: 
- Basic: ['Enabled']. Disabling core dumps is a foundational security practice recommended by benchmarks like CIS. It provides a baseline defense against sensitive information exposure from application crashes.
- Moderate: ['Enabled']. There is no effective intermediate state. For any production system, core dumps should be disabled unless they are actively required for debugging in a controlled, non-production environment.
- Strict: ['Enabled']. The most secure posture is to completely disable core dumps. The risk of sensitive data leakage far outweighs the diagnostic benefits in a hardened, secure environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if core dumps are restricted. The script should verify that '* hard core 0' is set in '/etc/security/limits.conf' or a file within '/etc/security/limits.d/', and that 'fs.suid_dumpable' is set to '0' via sysctl. If both conditions are met, the script should output 'Enabled'. Otherwise, it should output 'Disabled'. The script must only return the current state with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. If 'Enabled', the script must add '* hard core 0' to '/etc/security/limits.conf', set 'fs.suid_dumpable = 0' in a sysctl configuration file (e.g., /etc/sysctl.d/99-hardening.conf), apply the sysctl setting, and disable the 'systemd-coredump.service'. If 'Disabled', it should reverse these actions. The script must return 'true' on success and 'false' on failure.

