# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-BOOT-010
title: Keep no AppArmor profile in complain mode
finding:
  title: Some AppArmor profiles only log violations instead of blocking them
  description: A profile in complain mode confines nothing; the program it covers runs as if it had no profile.
status: active
profiles: [server-hardened, desktop-hardened]
risk:
  severity: medium
assessment: automated
tags: [apparmor, mac]

description: |
  Each loaded AppArmor profile runs in a mode. In `enforce` mode, accesses outside the profile
  are blocked and logged. In `complain` mode, they are only logged. Profiles flagged `unconfined`
  are a third case: they do not restrict the program but attach specific rights to it (Ubuntu
  24.04 and later ship many of them for user namespace mediation), and are out of scope here.

  Snap applications get profiles generated by snapd (`snap.<name>.<app>`). A snap installed
  with `--devmode` runs with its profiles in complain mode.
rationale: |
  Complain mode is meant for writing and testing profiles. A profile left in complain mode in
  production gives a false sense of confinement: the program is not restricted at all.
impact: |
  Switching a profile to enforce mode can break the program it covers if the profile is
  incomplete. Ubuntu ships some profiles in complain mode on purpose (the `transmission-*`
  profiles on 24.04, `Xorg` and `Xorg_wrap` on 26.04, on a server image); enforce them one by
  one, checking the logs (`journalctl -k | grep apparmor`) for denials. On a desktop, enforcing
  `Xorg` can break an Xorg session: test it before rolling it out.

audit:
  manual: |
    Run `aa-status --complaining`. It must print `0`.
    `aa-status` lists the profiles in complain mode by name.
  checks:
    - id: complain-count
      engine: shell
      description: Number of loaded profiles in complain mode.
      spec:
        script: |
          n=$(aa-status --complaining 2>/dev/null) || exit 3
          echo "$n"
          [ "$n" -eq 0 ]

remediation:
  manual: |
    1. List the profiles in complain mode: `aa-status`.
    2. For each one, install `apparmor-utils` and run `aa-enforce /etc/apparmor.d/<profile>`.
    3. Watch for denials with `journalctl -k | grep apparmor` and fix or revert the profile.
    4. Snap profiles cannot be changed with `aa-enforce`: snapd regenerates them. Reinstall a
       devmode snap in strict confinement (`snap refresh --jailmode <snap>` or without
       `--devmode`), or remove it.
  rollback: |
    Put a profile back in complain mode with `aa-complain /etc/apparmor.d/<profile>`.

references:
  - title: Snapcraft documentation - Snap confinement
    url: https://snapcraft.io/docs/snap-confinement
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: aa-status(8), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man8/aa-status.8.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: Ubuntu Server documentation - AppArmor
    url: https://documentation.ubuntu.com/server/how-to/security/apparmor/
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R45)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-19
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R45
    relation: partial
    note: R45 also asks for AppArmor to be enabled, which is CB-UBU-BOOT-008.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-3
    relation: related
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "1.3.1.3"
    relation: related
    note: The benchmark checks that no profile is disabled; this control checks complain mode.
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "1.3.1.4"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "1.3.1.3"
    relation: related
    note: The benchmark checks that no profile is disabled; this control checks complain mode.
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "1.3.1.4"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "1.3.1.3"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "1.3.1.3"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1068
related_controls:
  - id: CB-UBU-BOOT-008
    type: requires

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot
    notes: "Passes on a fresh cloud install (no profile in complain mode)."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot
    notes: "Passes on a fresh cloud install (no profile in complain mode)."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot
    notes: "Fails on a fresh install (4 transmission-* profiles in complain); aa-enforce from apparmor-utils makes it pass; kept after reboot; a strict snap still runs."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot
    notes: "Fails on a fresh install (Xorg and Xorg_wrap in complain); aa-enforce makes it pass; kept after reboot; a strict snap still runs."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19