securing oracle linux 9 part 6 process hardening and core dump management

سیستم عامل و زیرساخت Hits: 4

In the previous section:

Securing Bootloader (GRUB2) Configuration

was completed.

1. CIS Benchmark Requirements (Section 1.5)

This article covers and implements the following CIS controls regarding process-level hardening:

  • 1.5.1 Ensure address space layout randomization is enabled (Automated)
  • 1.5.2 Ensure ptrace_scope is restricted (Automated)
  • 1.5.3 Ensure core dump backtraces are disabled (Automated)
  • 1.5.4 Ensure core dump storage is disabled (Automated)

 

2. Concept & Rationale

In this section, three critical kernel mechanisms are configured to defend against memory exploits:

  • ASLR (Address Space Layout Randomization): Randomizes the memory addresses of system components (such as Stack, Heap, and libraries). This prevents attackers from guessing the exact address of sensitive functions, thereby significantly limiting attacks like Buffer Overflows.
  • Ptrace Scope: The ptrace capability is used for debugging processes. Restricting it prevents a standard process from reading the memory of other processes (a common technique for stealing passwords from memory).
  • Core Dump: When a program crashes, the operating system saves its memory contents into a file called a Core Dump. The CIS standard requires this feature to be completely disabled to prevent sensitive information (such as encryption keys or data residing in memory) from leaking into files on the disk.

 

3. Compatibility with Oracle Database (RAC & Grid)

  • ASLR and Ptrace: The standard secure values for these two parameters do not interfere with the operation of Oracle Database or Oracle Grid Infrastructure.
  • Core Dump (Critical Note for DBAs): Completely disabling Core Dumps conflicts with Oracle Support (MOS) requirements. During critical binary-level errors (severe crashes occurring before Oracle’s ADR system activates), the support team requires OS-level Core Dumps for debugging and providing patches.
  • Solution (Risk Acceptance): We disable Core Dump generation for all system users but define an explicit exception for the oracle and grid users. This represents a logical compromise between security and operations on database servers.

 

4. How to Audit the Current Status (Audit Script)

This script checks the status of kernel parameters and the restrictions applied to Core Dumps:

Link to this script on GitHub:

modules/audit_06_Process_Hardening_Core_Dump.sh

If you are not familiar with Bash scripting, you can refer to the tutorial I have published on the website for DBAs.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_5.sh
# Purpose: Audit Process Hardening & Core Dumps (CIS 1.5)

echo "=========================================================================="
echo " CIS Requirement: 1.5 Process Hardening"
echo " - Ensure core dumps are restricted (systemd & limits.conf)."
echo " - Ensure ASLR is enabled (kernel.randomize_va_space=2)."
echo " - Ensure ptrace scope is restricted."
echo " Oracle Context:"
echo " 1. ASLR is fully supported and recommended by Oracle."
echo " 2. Core dumps MUST NOT be restricted for 'oracle' and 'grid' users."
echo " They are required by Oracle Support for critical diagnostics (MOS)."
echo " 3. Restricting ptrace (scope=1) might require root privileges if DBA"
echo " needs to run strace/pstack on running Oracle processes."
echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] 1. Checking Core Dump Limits (limits.conf)..."
# Using -h to hide filenames during grep, ensuring ^# works correctly.
LIMIT_CHECK=$(grep -h -r "^\s*\*\s\+hard\s\+core\s\+0" /etc/security/limits.conf /etc/security/limits.d/ 2>/dev/null)
if [ -n "$LIMIT_CHECK" ]; then
echo -e " \e[32m[PASS]\e[0m System-wide core dumps are disabled in limits.conf (* hard core 0)."
else
echo -e " \e[31m[FAIL]\e[0m System-wide core dumps are NOT explicitly disabled in limits.conf."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 2. Checking Oracle/Grid Core Dump Exceptions..."
ORA_LIMIT=$(grep -h -r "^\s*oracle\s\+hard\s\+core\s\+unlimited" /etc/security/limits.conf /etc/security/limits.d/ 2>/dev/null)
if [ -n "$ORA_LIMIT" ]; then
echo -e " \e[32m[PASS]\e[0m Oracle exceptions for core dumps are correctly configured."
else
echo -e " \e[33m[WARN]\e[0m Oracle exceptions for core dumps are missing. This impacts diagnostics."
# Not failing the CIS check, but warning for Oracle context
fi

echo -e "\n[*] 3. Checking Systemd Coredump Configuration..."
# Checking both main conf and drop-in directories
SYSTEMD_CORE=$(grep -h -E "^\s*Storage\s*=\s*none" /etc/systemd/coredump.conf /etc/systemd/coredump.conf.d/*.conf 2>/dev/null)
if [ -n "$SYSTEMD_CORE" ]; then
echo -e " \e[32m[PASS]\e[0m Systemd coredump storage is set to 'none'."
else
echo -e " \e[31m[FAIL]\e[0m Systemd coredump storage is NOT set to 'none'."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 4. Checking ASLR (kernel.randomize_va_space)..."
ASLR=$(sysctl -n kernel.randomize_va_space 2>/dev/null)
if [ "$ASLR" == "2" ]; then
echo -e " \e[32m[PASS]\e[0m ASLR is enabled."
else
echo -e " \e[31m[FAIL]\e[0m ASLR is disabled or misconfigured (Current: $ASLR)."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

echo -e "\n[*] 5. Checking Ptrace Scope (kernel.yama.ptrace_scope)..."
PTRACE=$(sysctl -n kernel.yama.ptrace_scope 2>/dev/null)
if [ "$PTRACE" -ge 1 ]; then
echo -e " \e[32m[PASS]\e[0m Ptrace scope is restricted (Current: $PTRACE)."
else
echo -e " \e[31m[FAIL]\e[0m Ptrace scope is NOT restricted (Current: $PTRACE)."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi

if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. How to Apply Settings (Remediation Bash Script)

This script sets the security kernel parameters and creates the Core Dump limits file while accounting for the Oracle user exception.

Link to this script on GitHub:

modules/remediate_06_Process_Hardening_Core_Dump.sh

#!/bin/bash
# Script: remediate_cis_1_5.sh
# Purpose: Apply Process Hardening and Core Dump Limits (CIS 1.5)

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo -e "\n[+] Applying Remediation for Process Hardening (CIS 1.5)..."

# 1. System-wide and Oracle Specific Core Dump Limits
echo "[*] Configuring Core Dump limits with Oracle exceptions..."
cat <<EOF > /etc/security/limits.d/99-disable_core.conf
# CIS 1.5.1: Disable core dumps for all users to prevent info leaks
* hard core 0

# Oracle Exception: Required for Oracle Database / Grid Diagnostics (MOS)
oracle soft core unlimited
oracle hard core unlimited
grid soft core unlimited
grid hard core unlimited
EOF
echo " [+] Set limits in /etc/security/limits.d/99-disable_core.conf"

# 2. Systemd Coredump Configuration (OL9 Requirement)
echo "[*] Configuring systemd-coredump..."
mkdir -p /etc/systemd/coredump.conf.d/
cat <<EOF > /etc/systemd/coredump.conf.d/99-cis.conf
[Coredump]
Storage=none
ProcessSizeMax=0
EOF
systemctl daemon-reload
echo " [+] Set Storage=none in systemd coredump config."

# 3. Sysctl Parameters for ASLR and Ptrace
echo "[*] Configuring kernel parameters (ASLR & Ptrace)..."
cat <<EOF > /etc/sysctl.d/50-process-hardening.conf
# CIS 1.5.2: Enable ASLR
kernel.randomize_va_space = 2
# CIS 1.5.3: Restrict Ptrace
kernel.yama.ptrace_scope = 1
EOF

# Apply sysctl parameters
sysctl -q -p /etc/sysctl.d/50-process-hardening.conf
echo " [+] Applied kernel.randomize_va_space=2 and kernel.yama.ptrace_scope=1"

echo -e "\n[+] Process hardening applied successfully."

In the next part, we will cover

Configuring System-Wide Crypto Policy

.