Lesson 1.76: Core dumps that keep secrets
When a program crashes, Linux can save its whole memory to a core dump so developers can debug it later. That memory holds whatever the program had: database passwords, API keys, customer data. On servers these files pile up quietly. In the lab the payments API crashed this morning and systemd-coredump kept its memory. You find the dump, show what's inside, turn core dumps off for the host (and for setuid programs), keep a hash for the incident record and delete the dump.
16 min
You will learn to
- Find stored core dumps with coredumpctl
- Extract a dump and search it for secrets
- Read fs.suid_dumpable and kernel.core_pattern
- Disable core storage with a coredump.conf drop-in
- Handle a dump as evidence, then remove it
Key terms
- Core dump
- A file with a crashed process's memory, for later debugging.
- systemd-coredump
- The helper that receives crashes, logs them and stores the dumps in /var/lib/systemd/coredump.
- kernel.core_pattern
- Where the kernel sends a dump: a file name, or a | pipe to a helper program.
- fs.suid_dumpable
- Whether setuid and privilege-changing programs may dump: 0 no, 1 yes (unsafe), 2 root-readable only.
- Storage=none
- coredump.conf setting: log the crash, keep no memory.
← rsyslog and central logging · All lessons · Collecting a triage package →