{
  "id": 17401833,
  "title": "Why `suid_dumpable=2` Needs a Pipeline Check",
  "url": "https://urgent.news/2026/10/31/why-suid-dumpable-2-needs-a-pipeline-check",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-31T12:41:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/andreagomez/why-suiddumpable2-needs-a-pipeline-check-j90"
  },
  "original_language": "en",
  "account": "The fs.suid_dumpable setting on Linux controls how core dumps are handled for setuid processes. Mode 2 is the safest option because it only creates dumps when the kernel.core_pattern variable points to a pipe or a specific path. However, this safe mode only works if the core_pattern is properly configured to a pipe or valid path. If the core_pattern is set to an incorrect location or removed altogether, dumps could still end up in unexpected places, potentially exposing sensitive information.\n\nThe kernel documentation emphasizes that a dump may contain encryption keys, session data, and other privileged information. Therefore, it is crucial to verify that the core_pattern is set correctly and protected. Operators often inherit old core_pattern settings from configuration management defaults, which can lead to insecure dump locations if not regularly reviewed.\n\nTo ensure proper dump handling, it is recommended to test the configuration on a disposable host with a non-critical program. Set the expected sysctls, trigger a controlled crash, and observe whether the dump is written to the expected pipe or file location. Verify the permissions on the dump destination to ensure only authorized users can access the sensitive information.\n\nThe final review should answer four key questions: which services can generate dumps, where the kernel sends them, who can read the destination, and how long they are retained. If any of these factors depend on manual steps, those steps should be observable in configuration management and deployment checks to maintain a clear path from memory to secure deletion of sensitive data.",
  "summary": "Why suid_dumpable=2 Needs a Pipeline Check Core dumps help engineers diagnose crashes. They can also contain encryption keys, session material, submitted form data, and fragments of memory from privileged work. On Linux, the fs.suid_dumpable setting decides how the kernel treats dumps for processes that normally would not produce one. Mode 2 is the safe mode only when a second setting remains…",
  "key_points": [
    "fs.suiddumpable=2 setting controls core dumps for setuid processes",
    "Mode 2 creates dumps only with kernel.corepattern pointing to pipe or specific path",
    "Incorrect corepattern can expose sensitive information in unexpected locations"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}