| 1 |
# Alloy coredump policy: no cores on disk. |
| 2 |
# |
| 3 |
# WHAT THE STATE WAS, measured 2026-08-21 against the built image. The |
| 4 |
# `systemd-coredump` package is not installed, while Fedora's |
| 5 |
# /usr/lib/sysctl.d/50-coredump.conf still points `kernel.core_pattern` at |
| 6 |
# /usr/lib/systemd/systemd-coredump and sets `fs.suid_dumpable=2`. So the |
| 7 |
# kernel was piping cores to a binary that is not there. That is an accident |
| 8 |
# of a missing package, not a policy, and it reads identically to a policy |
| 9 |
# from the outside, which is why it gets stated here. |
| 10 |
# |
| 11 |
# `95-` so this lands after Fedora's `50-coredump.conf` and overrides all |
| 12 |
# three of its keys. |
| 13 |
# |
| 14 |
# WHAT IT COSTS: a crashed binary leaves nothing to debug. Getting a core |
| 15 |
# back is deliberate and temporary — `ulimit -c unlimited` plus |
| 16 |
# `sysctl -w kernel.core_pattern=core` in the shell doing the debugging. |
| 17 |
# That is the intended workflow, not a workaround. |
| 18 |
# |
| 19 |
# WHY AT ALL: a core file is the process's memory written to disk with the |
| 20 |
# permissions of whoever crashed. Anything the process had decrypted is in |
| 21 |
# it — keys, tokens, the contents of a password store. |
| 22 |
|
| 23 |
# Cores go nowhere. `|/bin/false` rather than an empty value: the kernel |
| 24 |
# treats an empty core_pattern as "use the default name", not "do not dump". |
| 25 |
kernel.core_pattern=|/bin/false |
| 26 |
|
| 27 |
# Left at the kernel default. 0 does not mean "no piping"; it means no limit on |
| 28 |
# how many crashes pipe in parallel, and no waiting on the collector. Stated |
| 29 |
# here because the name reads like an off switch and the line above is the one |
| 30 |
# doing the work. |
| 31 |
kernel.core_pipe_limit=0 |
| 32 |
|
| 33 |
# Never dump a setuid or capability-carrying process. Fedora sets 2 |
| 34 |
# ("suidsafe") to let systemd-coredump collect them; with no collector, 2 is |
| 35 |
# only a way for a privileged process's memory to reach the disk. |
| 36 |
fs.suid_dumpable=0 |
| 37 |
|