{
  "id": "CB-UBU-BOOT-013",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-013",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-013.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-013.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-BOOT-013",
    "title": "Disable core dumps",
    "finding": {
      "title": "Crashing programs can write their memory to disk",
      "description": "Core dumps can contain passwords, keys and personal data, and stay on disk long after the crash."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "core-dump",
      "pam",
      "systemd"
    ],
    "description": "A core dump is a copy of the memory of a process written when it crashes. On Ubuntu, three\nmechanisms decide whether one is written:\n\n- the `core` resource limit of the process, set for login sessions by `pam_limits` from\n  `/etc/security/limits.conf` and `/etc/security/limits.d/`;\n- when the `systemd-coredump` package is installed, its configuration\n  (`/etc/systemd/coredump.conf` and `/etc/systemd/coredump.conf.d/`), which stores the dumps\n  in `/var/lib/systemd/coredump/`;\n- apport, installed by default, which registers itself as the core dump handler in\n  `kernel.core_pattern` and stores crash reports, core dump included, in `/var/crash/`.\n\nThis control sets a hard `core` limit of 0 for every login session, and, with systemd-coredump,\n`Storage=none` and `ProcessSizeMax=0`. Apport is turned off by CB-UBU-BOOT-015.\n",
    "rationale": "The memory of a crashed process holds whatever it was working on: passwords typed by a user,\nsession tokens, private keys, documents. Core files are often readable by more people than the\noriginal process, are collected by support tools, and are rarely cleaned up.\n",
    "impact": "Crashes cannot be analysed from a core dump. When a crash must be debugged, raise the limit for\nthat one session (`ulimit -c unlimited` after removing the hard limit) on a test system.\n",
    "notes": "Ubuntu sets a soft limit of 0 but leaves the hard limit `unlimited` (26.04 sets it\nexplicitly in `/etc/security/limits.d/10-coredump-debian.conf`), so any user can turn dumps\nback on with `ulimit -c`. The file written by the fix sorts after it and wins.\n\nA core dump handler declared in `kernel.core_pattern` (a line starting with `|`) receives the\nmemory of the crashed process whatever its `core` limit: the kernel does not apply the limit to\na pipe, and what is kept is up to the handler. This is why the session limit is not enough on\nUbuntu while apport runs. Core dumps of setuid programs\nare covered separately by CB-UBU-BOOT-005.\n",
    "setting": {
      "location": "/etc/security/limits.d/, /etc/systemd/coredump.conf.d/",
      "default_value": "Soft limit 0, hard limit unlimited",
      "recommended_value": "Hard limit 0; with systemd-coredump, Storage=none and ProcessSizeMax=0"
    },
    "audit": {
      "manual": "1. Run `su -s /bin/sh nobody -c 'ulimit -Hc'`. It must print `0`.\n2. If systemd-coredump is installed, run `systemd-analyze cat-config systemd/coredump.conf`:\n   the last `Storage=` must be `none` and the last `ProcessSizeMax=` must be `0`.\n",
      "checks": [
        {
          "id": "session-limit",
          "engine": "shell",
          "description": "Hard core size limit applied to a login session.",
          "spec": {
            "script": "v=$(su -s /bin/sh nobody -c 'ulimit -Hc' 2>/dev/null) || exit 3\necho \"hard core limit: $v\"\n[ \"$v\" = 0 ]\n"
          }
        },
        {
          "id": "coredump-storage",
          "engine": "shell",
          "description": "Effective Storage= of systemd-coredump.",
          "facts": [
            "systemd-coredump"
          ],
          "spec": {
            "script": "v=$(systemd-analyze cat-config systemd/coredump.conf 2>/dev/null | sed -n 's/^[[:space:]]*Storage=//p' | tail -n 1)\necho \"Storage=${v:-external (default)}\"\n[ \"$v\" = none ]\n"
          }
        },
        {
          "id": "coredump-size",
          "engine": "shell",
          "description": "Effective ProcessSizeMax= of systemd-coredump.",
          "facts": [
            "systemd-coredump"
          ],
          "spec": {
            "script": "v=$(systemd-analyze cat-config systemd/coredump.conf 2>/dev/null | sed -n 's/^[[:space:]]*ProcessSizeMax=//p' | tail -n 1)\necho \"ProcessSizeMax=${v:-default}\"\n[ \"$v\" = 0 ]\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Create `/etc/security/limits.d/60-cirsec.conf` with:\n   ```\n   *    hard core 0\n   root hard core 0\n   ```\n2. If systemd-coredump is installed, create `/etc/systemd/coredump.conf.d/60-cirsec.conf` with:\n   ```\n   [Coredump]\n   Storage=none\n   ProcessSizeMax=0\n   ```\n3. Log out and back in for the session limit to apply.\n",
      "effects": {
        "restart": "session",
        "disruption": "none",
        "lockout_risk": false
      },
      "rollback": "Delete the two files. New sessions get the previous limits back.\n",
      "scripts": [
        {
          "id": "session-limit",
          "engine": "shell",
          "content": "f=/etc/security/limits.d/60-cirsec.conf\ncb_backup \"$f\"\nprintf '%s\\n' '# Written by CIRSEC Baselines CB-UBU-BOOT-013' '*    hard core 0' 'root hard core 0' >\"$f\"\nchmod 644 \"$f\"\n"
        },
        {
          "id": "coredump-conf",
          "engine": "shell",
          "facts": [
            "systemd-coredump"
          ],
          "content": "f=/etc/systemd/coredump.conf.d/60-cirsec.conf\ncb_backup \"$f\"\nmkdir -p /etc/systemd/coredump.conf.d\nprintf '%s\\n' '# Written by CIRSEC Baselines CB-UBU-BOOT-013' '[Coredump]' 'Storage=none' 'ProcessSizeMax=0' >\"$f\"\nchmod 644 \"$f\"\n"
        }
      ]
    },
    "references": [
      {
        "title": "limits.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/limits.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "coredump.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/coredump.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "core(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/core.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-11",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1003"
      },
      {
        "framework": "cwe",
        "id": "CWE-528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-BOOT-005",
        "type": "related"
      },
      {
        "id": "CB-UBU-BOOT-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "Fails on a fresh install (hard core limit unlimited); fix writes limits.d; kept after reboot; systemd-coredump not installed, its checks report not_applicable."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "Fails on a fresh install (hard core limit unlimited); fix writes limits.d; kept after reboot; systemd-coredump not installed, its checks report not_applicable."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Fails on a fresh install (hard core limit unlimited); fix writes limits.d; kept after reboot; systemd-coredump not installed, its checks report not_applicable."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Fails on a fresh install (hard core limit unlimited); fix writes limits.d; kept after reboot; systemd-coredump not installed, its checks report not_applicable."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}