Skip to main content

max / alloy

1.8 KB · 37 lines History Blame Raw
1 # Alloy coredump policy: no cores on disk.
2 #
3 # WHAT THE STATE WAS, measured 2026-08-21 against the built image. The
4 # `systemd-coredump` package is not installed, while Fedora's
5 # /usr/lib/sysctl.d/50-coredump.conf still points `kernel.core_pattern` at
6 # /usr/lib/systemd/systemd-coredump and sets `fs.suid_dumpable=2`. So the
7 # kernel was piping cores to a binary that is not there. That is an accident
8 # of a missing package, not a policy, and it reads identically to a policy
9 # from the outside, which is why it gets stated here.
10 #
11 # `95-` so this lands after Fedora's `50-coredump.conf` and overrides all
12 # three of its keys.
13 #
14 # WHAT IT COSTS: a crashed binary leaves nothing to debug. Getting a core
15 # back is deliberate and temporary — `ulimit -c unlimited` plus
16 # `sysctl -w kernel.core_pattern=core` in the shell doing the debugging.
17 # That is the intended workflow, not a workaround.
18 #
19 # WHY AT ALL: a core file is the process's memory written to disk with the
20 # permissions of whoever crashed. Anything the process had decrypted is in
21 # it — keys, tokens, the contents of a password store.
22
23 # Cores go nowhere. `|/bin/false` rather than an empty value: the kernel
24 # treats an empty core_pattern as "use the default name", not "do not dump".
25 kernel.core_pattern=|/bin/false
26
27 # Left at the kernel default. 0 does not mean "no piping"; it means no limit on
28 # how many crashes pipe in parallel, and no waiting on the collector. Stated
29 # here because the name reads like an off switch and the line above is the one
30 # doing the work.
31 kernel.core_pipe_limit=0
32
33 # Never dump a setuid or capability-carrying process. Fedora sets 2
34 # ("suidsafe") to let systemd-coredump collect them; with no collector, 2 is
35 # only a way for a privileged process's memory to reach the disk.
36 fs.suid_dumpable=0
37