{
  "id": "CB-UBU-BOOT-005",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-BOOT-005",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-BOOT-005.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-BOOT-005.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-BOOT-005",
    "title": "Disable core dumps of setuid programs",
    "finding": {
      "title": "Privileged programs can write their memory to core dump files",
      "description": "A crashing setuid program can leave secrets such as password hashes in a core file."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "kernel",
      "sysctl",
      "core-dump",
      "credentials"
    ],
    "description": "The `fs.suid_dumpable` sysctl decides whether a process that changed privileges (setuid or\nsetgid programs, or programs that dropped privileges) can produce a core dump when it crashes.\nWith `0`, such processes never dump core.\n",
    "rationale": "Setuid programs such as `passwd` or `su` handle secrets while running with root privileges.\nA core dump of their memory can expose password hashes, keys or tokens, and an attacker who\ncan make one crash may be able to read the dump.\n",
    "impact": "Crashes of setuid programs cannot be analysed from a core dump. Debug them on a test system.\n",
    "notes": "`1` dumps them like any process and `2` dumps them readable by root only. Both are unsafe\non production systems. Core dumps of regular processes are a separate topic.\n\nOn Ubuntu, apport writes `2` to `fs.suid_dumpable` when it starts, after `/etc/sysctl.d/` has\nbeen applied, and `0` when it stops. The value set by this fix only survives a reboot when\napport is disabled (CB-UBU-BOOT-015).\n",
    "setting": {
      "location": "sysctl `fs.suid_dumpable`, persisted in `/etc/sysctl.d/`",
      "default_value": "2 while apport runs, 0 otherwise",
      "recommended_value": "0"
    },
    "audit": {
      "manual": "Run `sysctl fs.suid_dumpable`. The value must be `0`.\nThen check that no sysctl configuration file sets another value.\n",
      "checks": [
        {
          "id": "running",
          "engine": "sysctl",
          "description": "Running value of fs.suid_dumpable.",
          "spec": {
            "key": "fs.suid_dumpable",
            "value": 0
          }
        }
      ]
    },
    "remediation": {
      "manual": "Create `/etc/sysctl.d/60-cirsec.conf` containing `fs.suid_dumpable = 0`,\nremove any other assignment of this key, then run `sysctl --system`.\n",
      "effects": {
        "restart": "none",
        "disruption": "none",
        "lockout_risk": false
      },
      "rollback": "Remove the line from `/etc/sysctl.d/60-cirsec.conf` and run `sysctl --system`.\n",
      "scripts": [
        {
          "id": "set",
          "from_check": "running"
        }
      ]
    },
    "references": [
      {
        "title": "Ubuntu Security documentation - Dangerous sysctls",
        "url": "https://documentation.ubuntu.com/security/common-mistakes/dangerous-sysctls/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Linux kernel documentation - Documentation for /proc/sys/fs/ (suid_dumpable)",
        "url": "https://docs.kernel.org/admin-guide/sysctl/fs.html",
        "publisher": "The Linux Kernel Organization",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R14)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R14",
        "relation": "partial",
        "note": "R14 lists several filesystem settings; this control covers fs.suid_dumpable."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-11",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1003"
      },
      {
        "framework": "cwe",
        "id": "CWE-528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-BOOT-015",
        "type": "requires"
      },
      {
        "id": "CB-UBU-BOOT-013",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "Fails on a fresh install (2, set by apport); passes once CB-UBU-BOOT-015 stops apport; 0 kept after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "Fails on a fresh install (2, set by apport); passes once CB-UBU-BOOT-015 stops apport; 0 kept after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Fails on a fresh install (2, set by apport); passes once CB-UBU-BOOT-015 stops apport; 0 kept after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Fails on a fresh install (2, set by apport); passes once CB-UBU-BOOT-015 stops apport; 0 kept after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}