Configure file name of core dumps
Sets kernel.core_uses_pid=0 so the kernel does not append a PID to core filenames, complementing the disabled-core-dump policy.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
kernel.core_uses_pid controls whether the running process's PID is appended to a core dump's filename (turning core into core.PID). When core dumps are disabled by setting kernel.core_pattern to an empty or no-op value, leaving core_uses_pid=1 causes the kernel to still try to append .PID, which can produce confusing shell error messages. Setting kernel.core_uses_pid=0 complements the disabled-core-dump policy so no core file is named or created and no spurious errors are printed.
What Pavois checks
Pavois reads the live kernel value via the kernel_parameter resource (equivalent to sysctl kernel.core_uses_pid), not /etc/sysctl.conf or any *.conf drop-in. A declared value in a file may be overridden by a later drop-in or never applied; reading the running kernel reflects the value actually in effect.
describe kernel_parameter('kernel.core_uses_pid') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*kernel.core_uses_pid[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl kernel.core_uses_pid, expected output kernel.core_uses_pid = 0.
Inspect & investigate
Read the current value with sysctl kernel.core_uses_pid or cat /proc/sys/kernel/core_uses_pid. This parameter itself produces no log; its purpose is to avoid spurious core-naming errors when core dumps are disabled, observe the absence of such messages on the shell or in journalctl -k after a crash.
Remediation
Pavois's harden plan sets the sysctl key kernel.core_uses_pid to 0, persisting it to a managed drop-in and applying it live so the running kernel and future boots both use it. Applied with pavois harden apply. It is best paired with the sysctl-kernel-core_pattern rule.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | kernel.core_uses_pid |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible risk. This only affects how a core file would be named, and is meaningful only in combination with a disabled core-dump policy; it does not by itself change whether dumps are produced. No service or application behavior is affected. Reversible by changing the key.