# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-BOOT-013
title: Disable core dumps
finding:
  title: Crashing programs can write their memory to disk
  description: Core dumps can contain passwords, keys and personal data, and stay on disk long after the crash.
status: active
profiles: [core]
risk:
  severity: low
assessment: automated
tags: [core-dump, pam, systemd]

description: |
  A core dump is a copy of the memory of a process written when it crashes. On Debian, two
  mechanisms decide whether one is written:

  - the `core` resource limit of the process, set for login sessions by `pam_limits` from
    `/etc/security/limits.conf` and `/etc/security/limits.d/`;
  - when the `systemd-coredump` package is installed, its configuration
    (`/etc/systemd/coredump.conf` and `/etc/systemd/coredump.conf.d/`), which stores the dumps
    in `/var/lib/systemd/coredump/`.

  This control sets a hard `core` limit of 0 for every login session, and, with systemd-coredump,
  `Storage=none` and `ProcessSizeMax=0`.
rationale: |
  The memory of a crashed process holds whatever it was working on: passwords typed by a user,
  session tokens, private keys, documents. Core files are often readable by more people than the
  original process, are collected by support tools, and are rarely cleaned up.
impact: |
  Crashes cannot be analysed from a core dump. When a crash must be debugged, raise the limit for
  that one session (`ulimit -c unlimited` after removing the hard limit) on a test system.
notes: |
  Debian 13 sets a soft limit of 0 but a hard limit of `infinity` in
  `/etc/security/limits.d/10-coredump-debian.conf`, so any user can turn dumps back on with
  `ulimit -c`. The file written by the fix sorts after it and wins. Core dumps of setuid programs
  are covered separately by CB-DEB-BOOT-005.

setting:
  location: /etc/security/limits.d/, /etc/systemd/coredump.conf.d/
  default_value: Soft limit 0, hard limit unlimited
  recommended_value: Hard limit 0; with systemd-coredump, Storage=none and ProcessSizeMax=0

audit:
  manual: |
    1. Run `su -s /bin/sh nobody -c 'ulimit -Hc'`. It must print `0`.
    2. If systemd-coredump is installed, run `systemd-analyze cat-config systemd/coredump.conf`:
       the last `Storage=` must be `none` and the last `ProcessSizeMax=` must be `0`.
  checks:
    - id: session-limit
      engine: shell
      description: Hard core size limit applied to a login session.
      spec:
        script: |
          v=$(su -s /bin/sh nobody -c 'ulimit -Hc' 2>/dev/null) || exit 3
          echo "hard core limit: $v"
          [ "$v" = 0 ]
    - id: coredump-storage
      engine: shell
      description: Effective Storage= of systemd-coredump.
      facts: [systemd-coredump]
      spec:
        script: |
          v=$(systemd-analyze cat-config systemd/coredump.conf 2>/dev/null | sed -n 's/^[[:space:]]*Storage=//p' | tail -n 1)
          echo "Storage=${v:-external (default)}"
          [ "$v" = none ]
    - id: coredump-size
      engine: shell
      description: Effective ProcessSizeMax= of systemd-coredump.
      facts: [systemd-coredump]
      spec:
        script: |
          v=$(systemd-analyze cat-config systemd/coredump.conf 2>/dev/null | sed -n 's/^[[:space:]]*ProcessSizeMax=//p' | tail -n 1)
          echo "ProcessSizeMax=${v:-default}"
          [ "$v" = 0 ]

remediation:
  manual: |
    1. Create `/etc/security/limits.d/60-cirsec.conf` with:
       ```
       *    hard core 0
       root hard core 0
       ```
    2. If systemd-coredump is installed, create `/etc/systemd/coredump.conf.d/60-cirsec.conf` with:
       ```
       [Coredump]
       Storage=none
       ProcessSizeMax=0
       ```
    3. Log out and back in for the session limit to apply.
  effects:
    restart: session
    disruption: none
    lockout_risk: false
  rollback: |
    Delete the two files. New sessions get the previous limits back.
  scripts:
    - id: session-limit
      engine: shell
      content: |
        f=/etc/security/limits.d/60-cirsec.conf
        cb_backup "$f"
        printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-BOOT-013' '*    hard core 0' 'root hard core 0' >"$f"
        chmod 644 "$f"
    - id: coredump-conf
      engine: shell
      facts: [systemd-coredump]
      content: |
        f=/etc/systemd/coredump.conf.d/60-cirsec.conf
        cb_backup "$f"
        mkdir -p /etc/systemd/coredump.conf.d
        printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-BOOT-013' '[Coredump]' 'Storage=none' 'ProcessSizeMax=0' >"$f"
        chmod 644 "$f"

references:
  - title: limits.conf(5), Debian manual pages
    url: https://manpages.debian.org/trixie/libpam-runtime/limits.conf.5.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: coredump.conf(5), Debian manual pages
    url: https://manpages.debian.org/trixie/systemd-coredump/coredump.conf.5.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-11
    relation: related
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "1.5.10"
    relation: stricter
    note: Ours also covers systemd-coredump (1.5.11 and 1.5.12).
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "1.5.11"
    relation: partial
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "1.5.12"
    relation: partial
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "1.5.10"
    relation: stricter
    note: Ours also covers systemd-coredump (1.5.11 and 1.5.12).
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "1.5.11"
    relation: partial
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "1.5.12"
    relation: partial
threats:
  - framework: mitre-attack
    id: T1003
  - framework: cwe
    id: CWE-528
related_controls:
  - id: CB-DEB-BOOT-005
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64, BIOS boot
    notes: Session limit fixed via limits.d; with systemd-coredump installed both coredump checks fail then pass after the fix; kept after reboot.
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64, BIOS boot
    notes: Session limit fixed via limits.d, overriding 10-coredump-debian.conf (hard core infinity); kept after reboot.
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18