{
  "id": "CB-UBU-BOOT-016",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-016",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-016.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-BOOT-016.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-BOOT-016",
    "title": "Restrict unprivileged user namespaces with AppArmor",
    "finding": {
      "title": "Any local program can create unprivileged user namespaces",
      "description": "User namespaces give an unprivileged process root-like capabilities over kernel interfaces that are a frequent source of privilege escalation bugs."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "apparmor",
      "kernel",
      "sysctl",
      "namespaces"
    ],
    "applicability": {
      "versions": [
        "24.04",
        "26.04"
      ],
      "conditions": "The sysctl only exists in Ubuntu kernels from 23.10 on. The 20.04 and 22.04 kernels do\nnot have it.\n"
    },
    "description": "With `kernel.apparmor_restrict_unprivileged_userns = 1`, an unprivileged process can only\ncreate a user namespace when its AppArmor profile allows it (the `userns` rule). Unconfined\nprograms get a namespace without any capability in it. Ubuntu ships profiles that grant the\nright to the programs that need it, such as browsers, Flatpak, LXC, Podman and Buildah.\n",
    "rationale": "Inside a user namespace, an unprivileged user holds capabilities such as `CAP_NET_ADMIN` or\n`CAP_SYS_ADMIN` over the namespace, which exposes large parts of the kernel (netfilter,\nfilesystems, network stacks) to them. Many local privilege escalation exploits start by\ncreating one. Restricting namespaces to profiled programs removes that entry point for\neverything else.\n",
    "impact": "None on a default install. A program that needs user namespaces and has no AppArmor profile\n(a self-built browser, an application from outside the archive, some sandboxing or container\ntools) fails to start its sandbox. Give it a profile with the `userns,` rule in\n`/etc/apparmor.d/` instead of turning the restriction off for the whole system.\n",
    "notes": "Ubuntu turns it on by default in `/usr/lib/sysctl.d/10-apparmor.conf` from 24.04 on. The\ncontrol guards against the common workaround of setting it back to `0` system-wide. Unlike\n`kernel.unprivileged_userns_clone`, it keeps namespaces available to the programs that are\nallowed to use them.\n",
    "setting": {
      "location": "sysctl `kernel.apparmor_restrict_unprivileged_userns`, persisted in `/etc/sysctl.d/`",
      "default_value": "1",
      "recommended_value": "1"
    },
    "audit": {
      "manual": "Run `sysctl kernel.apparmor_restrict_unprivileged_userns`. The value must be `1`.\nThen check that no sysctl configuration file sets it to `0`.\n",
      "checks": [
        {
          "id": "running",
          "engine": "sysctl",
          "description": "Running value of kernel.apparmor_restrict_unprivileged_userns.",
          "spec": {
            "key": "kernel.apparmor_restrict_unprivileged_userns",
            "value": 1
          }
        }
      ]
    },
    "remediation": {
      "manual": "Comment out every assignment of the key in `/etc/sysctl.conf`, `/etc/sysctl.d/` and\n`/run/sysctl.d/` (a file such as `99-userns.conf` sorts after `60-cirsec.conf` and wins), create\n`/etc/sysctl.d/60-cirsec.conf` containing `kernel.apparmor_restrict_unprivileged_userns = 1`,\nthen run `sysctl --system`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Remove the line from `/etc/sysctl.d/60-cirsec.conf` and run `sysctl --system`. Commented-out\nassignments can be restored from the backup directory `/var/backups/cirsec/`.\n",
      "scripts": [
        {
          "id": "set",
          "engine": "shell",
          "file": "fix.sh"
        }
      ]
    },
    "references": [
      {
        "title": "Ubuntu Security documentation - AppArmor (unprivileged user namespace restrictions)",
        "url": "https://documentation.ubuntu.com/security/security-features/privilege-restriction/apparmor/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu blog - Restricted unprivileged user namespaces are coming to Ubuntu 23.10",
        "url": "https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1068"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-BOOT-008",
        "type": "requires"
      },
      {
        "id": "CB-UBU-BOOT-009",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Passes on a fresh install (1); with /etc/sysctl.d/99-userns.conf setting 0 it fails, the fix comments it out; 1 kept after reboot; strict snap runs, unprivileged unshare -U refused."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Passes on a fresh install (1); with /etc/sysctl.d/99-userns.conf setting 0 it fails, the fix comments it out; 1 kept after reboot; strict snap runs, unprivileged unshare -U refused."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}