Where are my core dumps?

With systemd, your core dumps disappear into the systemd journal, instead of being stored to the current directory. They are unrecoverable for normal users, and they have to way of switching the core dump behaviour without being root. Giving users the permission to see their own core dumps (using systemd-coredumpctl) means to add them to the systemd-journal group, which obviously gives them more rights than should be necessary.


Also, being able to delete your own core dumps seems like a good idea. They may contain confidential information, after all.

For what it's worth, the kernel-level story here is that the kernel uses the contents of /proc/sys/kernel/core_pattern to figure out where to store the core dump. If this starts with a pipe character, it will run an executable and pass it to that, in our case /usr/lib/systemd/systemd-coredump.