# Ensure core dumps are restricted

Necessity: Core dumps are memory snapshots of a process at the time it crashes. These files can contain sensitive data, including passwords, private keys, and proprietary information, which were in memory when the application failed. Restricting the creation of core dumps is a critical security measure to prevent the leakage of this sensitive information, which could be exploited by an attacker with access to the system.

Auditing and Remediation: The audit script verifies two key system configurations. First, it checks that the `fs.suid_dumpable` kernel parameter is set to `0`, which prevents potentially vulnerable setuid/setgid programs from creating core dumps that could expose elevated privilege information. Second, it checks that `* hard core 0` is set in the system's security limits, which creates a system-wide block on core dump creation for all users. The remediation script configures both of these settings to establish a secure state.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Enabled'. This is a foundational security control with no common operational reason to be disabled on production systems. The risk of sensitive data exposure from core dumps is significant and applies universally. Therefore, security benchmarks like CIS universally recommend restricting core dumps, making 'Enabled' the only acceptable state for any security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if core dumps are restricted. The script must verify that the 'fs.suid_dumpable' kernel parameter is set to '0' and that a '* hard core 0' entry exists in '/etc/security/limits.conf' or a file within '/etc/security/limits.d/'. The script should output only the string 'Enabled' if both conditions are met, or 'Disabled' otherwise.

## Remediation Script Working

Bash script that accepts one argument: 'Enabled'. If the argument is 'Enabled', the script must configure the system to restrict core dumps by adding '* hard core 0' to '/etc/security/limits.conf' and setting 'fs.suid_dumpable = 0' in a sysctl configuration file (e.g., /etc/sysctl.d/99-security.conf) and applying it to the running kernel. The script must return 'true' on success and 'false' on failure.

