How to completely disable coredump?

Help
1

I have set systemd.coredump.enable = false but as I saw from the description from the option:

If disabled, core dumps appear in the current directory of the crashing process.

Does that mean coredump would still be generated?

I have also looked at the source code and found that if systemd coredump is not enabled, it would just write kernel.core_pattern=core to sysctl conf. But as I read from other guides, they often recommend setting kernel.core_pattern=|/bin/false and /bin/false is not avaliable on nixos.

So how do I completely disable coredump or is systemd.coredump.enable = false enough?

1 Like
2

This should work just fine on NixOS. The point of setting it to /bin/false is for it to fail, which it does on NixOS on account of it not existing.

2 Likes
3

I just discovered something like this stayed in my config long time ago:

boot.kernel.sysctl = lib.mkIf (!config.systemd.coredump.enable) {
  "kernel.core_pattern" = lib.mkForce " | ${pkgs.coreutils-full}/bin/false";
};
2 Likes
4

You can use lib.getExe' pkgs.coreutils-full "false", by the way. Not usually necessary, but it’s nice for packages that use (or switch to) split outputs.

1 Like
5

wow cool! didn’t know we can even write it like this. This is much cleaner.

6

I use "kernel.core_pattern" = lib.mkForce "/dev/null" and it works just as well.

7

Out of curiosity: why would someone disable this? What’s the use case or performance gain?

8

Core dump - ArchWiki explains:

Users may wish to disable automatic core dumps for a number of reasons:

  • Performance: generating core dumps for memory-heavy processes can waste system resources and delay the cleanup of memory.
  • Disk space: core dumps of memory-heavy processes may consume disk space equal to, if not greater, than the process’s memory footprint if not compressed.
  • Security: core dumps, although typically readable only by root, may contain sensitive data (such as passwords or cryptographic keys), which are written to disk following a crash.
1 Like
9

I think they’re pretty much useless on NixOS: virtually no package contains debug symbols by default, so the coredumps are unreadable but still waste a ton of disk space.

(I’m not sure why they’re even enabled by default)

6 Likes
10

Hmm, maybe my experiences are limited, but I certainly have not found coredumps on NixOS “pretty much useless”. Or maybe it’s just my luck and/or areas of interest?

We could tweak the coredump.conf and tmpfiles defaults to make them default to using less space (ExternalSizeMax, MaxUse, expiry date, etc), but I don’t have concrete recommendations.

These are crashes that I’ve ran into / helped with where the core dumps have indeed been pretty helpful, with nixseparatedebuginfod2 or not.

2 Likes
11

If one wants to let systemd log crashes without storing any core dumps, NixOS has an option to pass settings as per the systemd coredump docs:

  systemd.coredump = {
    enable = true;  # If false, systemd will not handle dumps, making the next bit useless
    settings.Coredump = {
      Storage = "none";
      ProcessSizeMax = "0";
    };

(Note systemd.coredump.settings.Coredump supersedes systemd.coredump.extraConfig from 26.05 onwards.)

1 Like