No memory dumps of privileged programs

Why it matters

When a program that runs with extra rights, such as sudo or passwd, crashes, the kernel can save its memory to a file. That memory can hold passwords, keys or hashes, and a file left in a readable place hands them to whoever finds it. Not writing the dump removes that leak.

How it works

Sets fs.suid_dumpable to 0, the traditional behavior: processes that changed privilege levels or are execute-only are not dumped. The other modes (1 and 2) deliberately allow dumps for debugging, with mode 1 unsafe according to the kernel documentation.

Who should use it

Good for any machine that is not used to debug setuid programs. Developers chasing a crash in a setuid tool can turn it back on temporarily.

What you may notice

Nothing in normal use. A crash of a privileged program leaves no core file or crash report, which only matters when you want to investigate that crash.

Check it on your computer

Read the current value:

sysctl fs.suid_dumpable

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w fs.suid_dumpable=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-fs-suid-dumpable.conf <<'EOF'
fs.suid_dumpable = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Limit one program inspecting another

Sources

Linux Hardening Guide (madaidans)

2.2.3

Linux kernel documentation

fs.suid_dumpable