{ "id": "CB-UBU-BOOT-010", "standard": "ubuntu", "version": "0.1.0", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-010.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-010.yml", "profiles_effective": [ "server-hardened", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-BOOT-010", "title": "Keep no AppArmor profile in complain mode", "finding": { "title": "Some AppArmor profiles only log violations instead of blocking them", "description": "A profile in complain mode confines nothing; the program it covers runs as if it had no profile." }, "status": "active", "profiles": [ "server-hardened", "desktop-hardened" ], "risk": { "severity": "medium" }, "assessment": "automated", "tags": [ "apparmor", "mac" ], "description": "Each loaded AppArmor profile runs in a mode. In `enforce` mode, accesses outside the profile\nare blocked and logged. In `complain` mode, they are only logged. Profiles flagged `unconfined`\nare a third case: they do not restrict the program but attach specific rights to it (Ubuntu\n24.04 and later ship many of them for user namespace mediation), and are out of scope here.\n\nSnap applications get profiles generated by snapd (`snap..`). A snap installed\nwith `--devmode` runs with its profiles in complain mode.\n", "rationale": "Complain mode is meant for writing and testing profiles. A profile left in complain mode in\nproduction gives a false sense of confinement: the program is not restricted at all.\n", "impact": "Switching a profile to enforce mode can break the program it covers if the profile is\nincomplete. Ubuntu ships some profiles in complain mode on purpose (the `transmission-*`\nprofiles on 24.04, `Xorg` and `Xorg_wrap` on 26.04, on a server image); enforce them one by\none, checking the logs (`journalctl -k | grep apparmor`) for denials. On a desktop, enforcing\n`Xorg` can break an Xorg session: test it before rolling it out.\n", "audit": { "manual": "Run `aa-status --complaining`. It must print `0`.\n`aa-status` lists the profiles in complain mode by name.\n", "checks": [ { "id": "complain-count", "engine": "shell", "description": "Number of loaded profiles in complain mode.", "spec": { "script": "n=$(aa-status --complaining 2>/dev/null) || exit 3\necho \"$n\"\n[ \"$n\" -eq 0 ]\n" } } ] }, "remediation": { "manual": "1. List the profiles in complain mode: `aa-status`.\n2. For each one, install `apparmor-utils` and run `aa-enforce /etc/apparmor.d/`.\n3. Watch for denials with `journalctl -k | grep apparmor` and fix or revert the profile.\n4. Snap profiles cannot be changed with `aa-enforce`: snapd regenerates them. Reinstall a\n devmode snap in strict confinement (`snap refresh --jailmode ` or without\n `--devmode`), or remove it.\n", "rollback": "Put a profile back in complain mode with `aa-complain /etc/apparmor.d/`.\n" }, "references": [ { "title": "Snapcraft documentation - Snap confinement", "url": "https://snapcraft.io/docs/snap-confinement", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "aa-status(8), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man8/aa-status.8.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "Ubuntu Server documentation - AppArmor", "url": "https://documentation.ubuntu.com/server/how-to/security/apparmor/", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R45)", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "anssi-linux", "framework_version": "2.0", "id": "R45", "relation": "partial", "note": "R45 also asks for AppArmor to be enabled, which is CB-UBU-BOOT-008." }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-3", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1068" } ], "related_controls": [ { "id": "CB-UBU-BOOT-008", "type": "requires" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot", "notes": "Passes on a fresh cloud install (no profile in complain mode)." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot", "notes": "Passes on a fresh cloud install (no profile in complain mode)." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot", "notes": "Fails on a fresh install (4 transmission-* profiles in complain); aa-enforce from apparmor-utils makes it pass; kept after reboot; a strict snap still runs." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot", "notes": "Fails on a fresh install (Xorg and Xorg_wrap in complain); aa-enforce makes it pass; kept after reboot; a strict snap still runs." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }