Stop unconfined unprivileged processes from switching AppArmor profiles

Description

kernel.apparmor_restrict_unprivileged_unconfined turns on the AppArmor restrictions for processes that are both unprivileged and unconfined (running without any profile). With 1, such a process cannot use change_profile (for example through aa-exec) to move itself to another profile.

Ubuntu 26.04 turns it on by default in /usr/lib/sysctl.d/10-apparmor.conf; Ubuntu 24.04 leaves it off. The companion setting kernel.apparmor_restrict_unprivileged_userns is CB-UBU-BOOT-016.

Rationale

Some AppArmor profiles grant rights that unconfined processes do not have by default, such as creating user namespaces. Without this restriction, any local process could switch to such a profile and use those rights, which bypasses the policy.

Impact

Unprivileged users can no longer run programs under a chosen profile with aa-exec. Programs launched normally get their profile attached as usual.

Applies when

Versions: 24.0426.04

The sysctl only exists in kernels that carry the AppArmor unprivileged restriction feature: Ubuntu kernels from 23.10 on. The 20.04 and 22.04 kernels do not have it.

Setting

Audit

Run sysctl kernel.apparmor_restrict_unprivileged_unconfined. The value must be 1.

Automated: every check must pass. Scanners report each check by its id.

running

Running value of kernel.apparmor_restrict_unprivileged_unconfined.

key: kernel.apparmor_restrict_unprivileged_unconfined
value: 1

Remediation

Create /etc/sysctl.d/60-cirsec.conf containing kernel.apparmor_restrict_unprivileged_unconfined = 1, then run sysctl --system.

Rollback

Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl --system (back to the distribution default).

set

Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Ubuntu blog - Restricted unprivileged user namespaces are coming to Ubuntu 23.10 Canonical, vendor-doc, accessed 2026-10-19
• AppArmor wiki - unprivileged unconfined restriction AppArmor project, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-UBU-BOOT-008 Install and enable AppArmor
• related CB-UBU-BOOT-016 Restrict unprivileged user namespaces with AppArmor

People and lifecycle