Kernel core dumps must be disabled unless needed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22404	GEN003510 M6	SV-38198r1_rule	ECSC-1	Medium

Description
Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in Denial of Service by exhausting the available space on the target file system. The kernel core dump process may increase the amount of time a system is unavailable due to a crash. Kernel core dumps can be useful for kernel debugging.

Description

Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in Denial of Service by exhausting the available space on the target file system. The kernel core dump process may increase the amount of time a system is unavailable due to a crash. Kernel core dumps can be useful for kernel debugging.

STIG	Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft	2013-01-10

Details

Check Text ( C-37656r1_chk )
Open a terminal session and use the following command to verify the system does not allow core dumps. sysctl -a \| grep kern.coredump If kern.coredump is not set to 0, this is a finding.

Fix Text (F-32897r1_fix)
Open a terminal session and edit the /etc/sysctl.conf file and add the following entry. kern.coredump=0 NOTE: If the sysctl.conf file does not exist use the following command to create one. touch /etc/sysctl.conf