From 4483378fec94ab3af9ad12e66bc6bc8697a673c6 Mon Sep 17 00:00:00 2001 From: zshi Date: Tue, 28 Mar 2017 14:18:52 +0800 Subject: Disable core dump for setuid programs The core dump of a setuid program is more likely to contain sensitive data, as the program itself runs with greater privileges than the user who initiated execution of the program. Disabling the ability for any setuid program to write a core file decreases the risk of unauthorized access of such data. This change sets core dump for setuid programs to '0'. Change-Id: Ib05d993c1bb59b59c784e438f805733f636c743d Signed-off-by: zshi --- puppet/services/kernel.yaml | 2 ++ 1 file changed, 2 insertions(+) (limited to 'puppet/services/kernel.yaml') diff --git a/puppet/services/kernel.yaml b/puppet/services/kernel.yaml index ee4c771f..bc4380a5 100644 --- a/puppet/services/kernel.yaml +++ b/puppet/services/kernel.yaml @@ -58,5 +58,7 @@ outputs: value: {get_param: KernelPidMax} kernel.dmesg_restrict: value: 1 + fs.suid_dumpable: + value: 0 step_config: | include ::tripleo::profile::base::kernel -- cgit 1.2.3-korg