openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Disable core dump for setuid programs 

The core dump of a setuid program is more likely
to contain sensitive data, as the program itself
runs with greater privileges than the user who
initiated execution of the program. Disabling the
ability for any setuid program to write a core
file decreases the risk of unauthorized access of
such data.

This change sets core dump for setuid programs
to '0'.

Change-Id: Ib05d993c1bb59b59c784e438f805733f636c743d
Signed-off-by: zshi <zshi@redhat.com>
This commit is contained in:
zshi 2017-03-28 14:18:52 +08:00
parent 0e76a20cae
commit 4483378fec
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
puppet/services/kernel.yaml
View File

@ -58,5 +58,7 @@ outputs:
value: {get_param: KernelPidMax}
kernel.dmesg_restrict:
value: 1
fs.suid_dumpable:
value: 0
step_config: |
include ::tripleo::profile::base::kernel

12
releasenotes/notes/disable-core-dump-for-setuid-programs-e83a2a5da908b9c3.yaml Normal file
View File

@ -0,0 +1,12 @@
---
upgrade:
- |
The fs.suid_dumpable kernel parameter is now explicitly set to 0 to prevent
exposing sensitive data through core dumps of processes with elevated
permissions. Deployments that set or depend on non-zero values for
fs.suid_dumpable may be affected by upgrading.
security:
- |
Explicitly disable core dump for setuid programs by setting
fs.suid_dumpable = 0, this will descrease the risk of unauthorized access
of core dump file generated by setuid program.