Core dumps of setuid processes are not restricted
What this means
fs.suid_dumpable is 1 (“debuggable”) — a crashed setuid/setgid process dumps core as a file the invoking (unprivileged) user can read, which can leak secrets that were in that process's memory (keys, passwords, tokens) to a lower-privileged user. This is distinct from the safer “0” (no dump) or “2” (routed through a controlled dump handler like systemd-coredump/apport) settings.
How to fix it
Set fs.suid_dumpable=0 via /etc/sysctl.d/ and run sysctl --system.
Check it yourself
Run a scan and look for BLWK-KERNEL-009 in the results:
bulwark scanInstalled the standalone CLI package instead of the app? The command is bulwarkctl.
How Bulwark decides
Bulwark reads sysctl_kernel and reports this check when:
suid_dumpable == 1If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.
References
- CIS Benchmark 1.5.6
- MITRE ATT&CK T1003
Related checks
- Cron entry runs a downloader piped to a shell ·
BLWK-ACCT-001 - Password maximum age is excessively long ·
BLWK-ACCT-002 - Password minimum age is zero ·
BLWK-ACCT-003 - Password hashing rounds are not explicitly configured ·
BLWK-ACCT-004 - Default UMASK is not explicitly configured ·
BLWK-ACCT-005 - A sensitive system file is world-writable ·
BLWK-FS-001