Disable storing core dumps
Sets kernel.core_pattern=|/bin/false so crashing processes pipe their core to a no-op handler and no core dump is ever written to disk.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A core dump is a memory image written when the kernel terminates an application after a crash. That image can hold passwords, keys, tokens, or other sensitive in-memory data, and is generally useful only to developers debugging a fault. Setting kernel.core_pattern=|/bin/false pipes every core to /bin/false, which immediately exits without writing anything, so no core file is ever stored on disk, eliminating a common avenue for sensitive-data leakage.
What Pavois checks
Pavois reads the live kernel value via the kernel_parameter resource (equivalent to sysctl kernel.core_pattern), not /etc/sysctl.conf or any *.conf drop-in. On systemd hosts the pattern is often set to |/usr/lib/systemd/systemd-coredump ... at boot, which can silently override a file-declared value; reading the running kernel reveals the handler that is actually in effect.
describe kernel_parameter('kernel.core_pattern') do
its('value') { should cmp '|/bin/false' }
end
describe command("grep -hsE '^[[:space:]]*kernel.core_pattern[[:space:]]*=[[:space:]]*\|/bin/false([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl kernel.core_pattern, expected output kernel.core_pattern = |/bin/false.
Inspect & investigate
Read the current value with sysctl kernel.core_pattern or cat /proc/sys/kernel/core_pattern. With the no-op handler, crashes still log to dmesg / journalctl -k but journalctl -u systemd-coredump will show no stored dumps and coredumpctl list should be empty.
Remediation
Pavois's harden plan sets the sysctl key kernel.core_pattern to |/bin/false, persisting it to a managed drop-in and applying it live so the running kernel and future boots both use it. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | kernel.core_pattern |
|---|---|
| resource | sysctl |
| value | |/bin/false |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low operational risk: you lose the ability to collect core dumps for crash debugging on this host. On systemd systems this overrides systemd-coredump, so coredumpctl will have nothing to show. If you need to diagnose a specific crash, temporarily restore the default pattern, reproduce, then re-apply. Note a boot-time service may reset core_pattern; the managed drop-in re-asserts it. Reversible by changing the key.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| PCI DSS | 3.3.1.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.