Disable core dumps of setuid programs

Description

The fs.suid_dumpable sysctl decides whether a process that changed privileges (setuid or setgid programs, or programs that dropped privileges) can produce a core dump when it crashes. With 0, such processes never dump core.

1 dumps them like any process and 2 dumps them readable by root only. Both are unsafe on production systems. Core dumps of regular processes are a separate topic.

Rationale

Setuid programs such as passwd or su handle secrets while running with root privileges. A core dump of their memory can expose password hashes, keys or tokens, and an attacker who can make one crash may be able to read the dump.

Impact

Crashes of setuid programs cannot be analysed from a core dump. Debug them on a test system.

Setting

Audit

Run sysctl fs.suid_dumpable. The value must be 0. Then check that no sysctl configuration file sets another value.

Automated: every check must pass. Scanners report each check by its id.

running

Running value of fs.suid_dumpable.

key: fs.suid_dumpable
value: 0

Remediation

Create /etc/sysctl.d/60-cirsec.conf containing fs.suid_dumpable = 0, remove any other assignment of this key, then run sysctl --system.

Rollback

Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl --system.

set

Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Linux kernel documentation - Documentation for /proc/sys/fs/ (suid_dumpable) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R14) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle