In this lesson, you will learn how to protect sensitive data cached in swap space and memory dumps by restricting filesystem access to these files.
The Problem: Memory on Disk
When your system runs low on RAM, the kernel moves inactive memory pages to a designated disk area called "swap." Similarly, when a process crashes, the system may write its memory contents to a "core dump" file. If these files are left unprotected, an attacker with local access could potentially read sensitive credentials, encryption keys, or private data that were temporarily stored in RAM.
Securing Swap Files
If you use a swap file (rather than a dedicated partition), it acts as a regular file on your filesystem. By default, swap files are often readable by the root user, but you must ensure the permissions are locked down so no other user or service can inspect them.
To secure your swap file, you should strictly limit its access rights:
# Set ownership to root
sudo chown root:root /swapfile
# Restrict permissions to read/write only for the owner
sudo chmod 0600 /swapfile
By setting the permissions to 0600, you ensure that only the root user (and the kernel) can interact with the data written to that file, effectively blocking unauthorized local users from scraping memory contents.
Securing Core Dumps
Core dumps are equally dangerous as they contain the full state of a program at the time of failure. You can harden your system by either disabling core dumps entirely or restricting where they are saved and who can read them.
You can restrict core dump accessibility by modifying the /etc/security/limits.conf file to set a hard limit of 0 for core dumps, or by ensuring the directory where they are written (/var/crash or similar) has restricted filesystem permissions (e.g., 0700), preventing non-administrative users from browsing them.
Always remember that data in RAM is just as sensitive as data on your disk; whenever the kernel moves that data to persistent storage, you must treat those files with the same security rigor as your most protected configuration files.
Key Takeaway: Because swap files and memory dumps expose sensitive RAM contents to the disk, you must enforce strict 0600 permissions to ensure only the root user can access these potential data leaks.