Ensure core dumps are restricted task (1.6.4) missing changes needed in /etc/security/limits.conf

[jrbeilke]

Seems the SCORED | 1.6.4 | PATCH | Ensure core dumps are restricted task is only partially complete, setting fs.suid_dumpable for sysctl, but missing the changes needed in /etc/security/limits.conf

These are the full remediation steps per the CIS benchmark for core dumps:

Remediation:
Add the following line to /etc/security/limits.conf or a /etc/security/limits.d/* file:
* hard core 0

Set the following parameter in /etc/sysctl.conf or a /etc/sysctl.d/* file:
fs.suid_dumpable = 0

Run the following command to set the active kernel parameter:
# sysctl -w fs.suid_dumpable=0

If systemd-coredump is installed:
edit /etc/systemd/coredump.conf and add/modify the following lines:

Storage=none
ProcessSizeMax=0

Run the command:
systemctl daemon-reload

[jrbeilke]

Here's an example using lineinfile to update /etc/security/limits.conf accordingly:

- name: "SCORED | 1.6.4 | PATCH | Ensure core dumps are restricted"
  lineinfile:
      state: present
      dest: /etc/security/limits.conf
      regexp: '^#?\\*.*core'
      line: '*                hard    core            0'
      insertbefore: '^# End of file'
  when:
      - ubtu18cis_rule_1_6_4
  tags:
      - level1-server
      - level1-workstation
      - scored
      - patch
      - rule_1.6.4
      - coredump