When a background process or application crashes in Linux (a segmentation fault), the kernel’s default behavior is to take an exact snapshot of what was inside the physical RAM at the exact moment of the crash. It writes this massive data snapshot to your hard drive as a file called a Core Dump.
For a C++ developer debugging a complex application, a core dump is invaluable. However, for a production web server, core dumps are a disaster. First, if a buggy application crashes continuously in a loop, it will generate thousands of massive core dump files, silently consuming your entire hard drive until the server hits 100% capacity and goes offline. Second, the core dump is an unencrypted copy of RAM. If your database crashes, the core dump might contain plaintext passwords or credit card numbers that were being processed at that exact second, creating a massive security vulnerability.
To maximize security and prevent storage exhaustion, you should completely disable the generation of core dumps across your entire Linux environment.
Step 1: Set the Soft Limit via Ulimit
The most immediate way to prevent a user session from generating core dumps is to set the maximum allowed file size for a core dump to zero bytes using ulimit.
- Open a terminal on your Linux server.
- Execute the following command:
ulimit -c 0
This instructs the system that the maximum size of a core dump is 0. Therefore, when an app crashes, the file simply cannot be written. However, this is temporary and only applies to the current shell session.
Step 2: Permanently Disable Core Dumps in Limits.conf
To enforce this rule globally for every single user and background service on the machine, you must edit the master security limits configuration file.
- Open the configuration file using a text editor with root privileges:
sudo nano /etc/security/limits.conf - Scroll to the absolute bottom of the file.
- Paste the following exact line (the asterisk means it applies to all users):
* hard core 0 - Press Ctrl+O then Enter to save the file. Press Ctrl+X to exit nano.
Step 3: Modify the Kernel Parameters (sysctl)
Modern Linux distributions often use systemd-coredump or other kernel-level crash handlers that might bypass user limits. To ensure absolute compliance, you should alter the sysctl rules.
- Open the sysctl configuration file:
sudo nano /etc/sysctl.conf - Add the following line to the bottom:
fs.suid_dumpable = 0 - Save and exit nano.
- Force the kernel to reload the rules immediately by running:
sudo sysctl -p
The Result
Your server is now strictly prohibited from copying RAM to the hard drive during a segmentation fault. You have eliminated the risk of catastrophic disk exhaustion loops and permanently closed a critical vector for accidental data leakage in production environments.