Why `suid_dumpable=2` Needs a Pipeline Check

The fs.suid_dumpable setting on Linux controls how core dumps are handled for setuid processes. Mode 2 is the safest option because it only creates dumps when the kernel.core_pattern variable points to a pipe or a specific path. However, this safe mode only works if the core_pattern is properly configured to a pipe or valid path. If the core_pattern is set to an incorrect location or removed altogether, dumps could still end up in unexpected places, potentially exposing sensitive information.

The kernel documentation emphasizes that a dump may contain encryption keys, session data, and other privileged information. Therefore, it is crucial to verify that the core_pattern is set correctly and protected. Operators often inherit old core_pattern settings from configuration management defaults, which can lead to insecure dump locations if not regularly reviewed.

To ensure proper dump handling, it is recommended to test the configuration on a disposable host with a non-critical program. Set the expected sysctls, trigger a controlled crash, and observe whether the dump is written to the expected pipe or file location. Verify the permissions on the dump destination to ensure only authorized users can access the sensitive information.

The final review should answer four key questions: which services can generate dumps, where the kernel sends them, who can read the destination, and how long they are retained. If any of these factors depend on manual steps, those steps should be observable in configuration management and deployment checks to maintain a clear path from memory to secure deletion of sensitive data.