Core dumps disabled (limits hard core 0)
Enforces a hard limit of 0 on core dump file size for all users via * hard core 0 in PAM limits, so processes cannot write memory dumps to disk.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
A core dump is a snapshot of a process's memory written to disk when it crashes. That memory can contain passwords, private keys, session tokens and other secrets held in clear by the application. If core dumps are unlimited, any crash (or an attacker deliberately crashing a service) can leak these secrets to a file readable later, and large dumps can also fill the filesystem (denial of service). Setting a hard limit of 0 removes this exposure.
What Pavois checks
Pavois greps the effective PAM limits configuration, /etc/security/limits.conf and every drop-in under /etc/security/limits.d/, for * hard core 0. Scanning the directory (not just the main file) is what catches the rule when it is shipped as a drop-in, which a file-only check of limits.conf would miss.
describe command('grep -rqE \'^\\*[[:space:]]+hard[[:space:]]+core[[:space:]]+0\' /etc/security/limits.conf /etc/security/limits.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rE '^\*[[:space:]]+hard[[:space:]]+core[[:space:]]+0' /etc/security/limits.conf /etc/security/limits.d/. It should print a matching line. You can also confirm the live value with ulimit -Hc in a fresh login shell, which should return 0.
Inspect & investigate
There is no dedicated log. Verify the active limit with ulimit -Hc (per shell) and check the kernel core pattern with sysctl kernel.core_pattern. Systemd-handled crashes appear via coredumpctl list (which should show nothing new once dumps are disabled).
Remediation
No automated remediation is shipped for this rule yet, so it must be applied manually: add the line * hard core 0 to a file under /etc/security/limits.d/ (e.g. 99-Pavois.conf). For full coverage also set kernel.core_pattern via sysctl and disable systemd-coredump.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | * hard core 0 |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/security/limits.d/99-pavois-core.conf |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling core dumps has very low operational risk. The main consequence is that developers and support teams lose post-mortem crash dumps used to debug native applications. Before applying on a system where you actively diagnose crashes, make sure you have an alternative (reproduce in a controlled lab, or temporarily allow dumps for a specific service). For production servers this is safe and recommended.