{
  "id": "CB-UBU-BOOT-009",
  "standard": "ubuntu",
  "version": "0.1.0",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-009",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-009.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-009.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-BOOT-009",
    "title": "Stop unconfined unprivileged processes from switching AppArmor profiles",
    "finding": {
      "title": "Unprivileged unconfined processes can move to a more permissive AppArmor profile",
      "description": "A process with no profile can use aa-exec or change_profile to pick a profile that grants rights it should not have."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "apparmor",
      "mac",
      "sysctl"
    ],
    "applicability": {
      "versions": [
        "24.04",
        "26.04"
      ],
      "conditions": "The sysctl only exists in kernels that carry the AppArmor unprivileged restriction\nfeature: Ubuntu kernels from 23.10 on. The 20.04 and 22.04 kernels do not have it.\n"
    },
    "description": "`kernel.apparmor_restrict_unprivileged_unconfined` turns on the AppArmor restrictions for\nprocesses that are both unprivileged and unconfined (running without any profile). With `1`,\nsuch a process cannot use `change_profile` (for example through `aa-exec`) to move itself to\nanother profile.\n",
    "rationale": "Some AppArmor profiles grant rights that unconfined processes do not have by default, such as\ncreating user namespaces. Without this restriction, any local process could switch to such a\nprofile and use those rights, which bypasses the policy.\n",
    "impact": "Unprivileged users can no longer run programs under a chosen profile with `aa-exec`.\nPrograms launched normally get their profile attached as usual.\n",
    "notes": "Ubuntu 26.04 turns it on by default in `/usr/lib/sysctl.d/10-apparmor.conf`; Ubuntu 24.04\nleaves it off. The companion setting `kernel.apparmor_restrict_unprivileged_userns` is\nCB-UBU-BOOT-016.\n",
    "setting": {
      "location": "sysctl `kernel.apparmor_restrict_unprivileged_unconfined`, persisted in `/etc/sysctl.d/`",
      "default_value": "0 on 24.04, 1 on 26.04",
      "recommended_value": "1"
    },
    "audit": {
      "manual": "Run `sysctl kernel.apparmor_restrict_unprivileged_unconfined`. The value must be `1`.\n",
      "checks": [
        {
          "id": "running",
          "engine": "sysctl",
          "description": "Running value of kernel.apparmor_restrict_unprivileged_unconfined.",
          "spec": {
            "key": "kernel.apparmor_restrict_unprivileged_unconfined",
            "value": 1
          }
        }
      ]
    },
    "remediation": {
      "manual": "Create `/etc/sysctl.d/60-cirsec.conf` containing\n`kernel.apparmor_restrict_unprivileged_unconfined = 1`, then run `sysctl --system`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Remove the line from `/etc/sysctl.d/60-cirsec.conf` and run\n`sysctl --system` (back to the distribution default).\n",
      "scripts": [
        {
          "id": "set",
          "from_check": "running"
        }
      ]
    },
    "references": [
      {
        "title": "Ubuntu blog - Restricted unprivileged user namespaces are coming to Ubuntu 23.10",
        "url": "https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "AppArmor wiki - unprivileged unconfined restriction",
        "url": "https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined_restriction",
        "publisher": "AppArmor project",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1548"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-BOOT-008",
        "type": "requires"
      },
      {
        "id": "CB-UBU-BOOT-016",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Fails on a fresh install (0); generated fix sets 1; kept after reboot; fix idempotent; 20.04 and 22.04 report not_applicable."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Passes on a fresh install (1, distribution default); still passes after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}