# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-NET-023
title: Restrict access to netplan configuration files
finding:
  title: Netplan configuration files can be read or changed by non-root users
  description: Netplan files hold Wi-Fi passphrases, VPN keys and the addressing of the host; readable or writable copies leak secrets or let anyone change the network at the next apply.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [netplan, network, permissions, secrets]

description: |
  Ubuntu describes its network configuration in YAML files under `/etc/netplan/`, which netplan
  turns into systemd-networkd or NetworkManager configuration at boot. Cloud images write
  `50-cloud-init.yaml` there, and desktops store the connections made in the GNOME settings as
  `90-NM-*.yaml`. This control requires every `/etc/netplan/*.yaml` file to belong to `root:root`
  with mode `0600` at most.
rationale: |
  These files can contain Wi-Fi passphrases (`password` under `wifis`), WireGuard private keys,
  802.1X credentials and static routes. Netplan itself recommends root-only files and warns, on
  each `netplan apply`, about files that other users can read. A file writable by another user
  changes the addresses, routes or DNS servers of the host at the next boot.
impact: |
  Users other than root can no longer read the network configuration with `cat`; `netplan get` and
  `ip address` still show the active settings.
notes: |
  Ubuntu 22.04 and later create `50-cloud-init.yaml` with mode `0600`; 20.04 creates it with
  `0644`, which is why this control fails there on a fresh install. Netplan reads only `*.yaml`
  files. Files under `/run/netplan/` and `/lib/netplan/` are generated or shipped by packages and
  are not covered.

setting:
  location: /etc/netplan/*.yaml
  default_value: 0600 (0644 on 20.04)
  recommended_value: root:root, 0600

audit:
  manual: |
    Run `stat -c '%n %U:%G %a' /etc/netplan/*.yaml`. Every file must be `root:root` with mode `600`
    or stricter.
  checks:
    - id: netplan-files
      engine: file-perms
      description: Netplan YAML files.
      spec: { path: /etc/netplan/*.yaml, owner: root, group: root, mode: "0600" }

remediation:
  manual: |
    Run `chown root:root /etc/netplan/*.yaml` and `chmod 600 /etc/netplan/*.yaml`, then
    `netplan generate` to check that no permission warning remains.
  effects:
    restart: none
    disruption: none
    lockout_risk: false
  rollback: |
    Run `chmod 644 /etc/netplan/<file>.yaml` to restore the previous mode.
  scripts:
    - id: netplan-files
      from_check: netplan-files

references:
  - title: Netplan documentation - Security
    url: https://netplan.readthedocs.io/en/stable/security/
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: netplan(5), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man5/netplan.5.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: Ubuntu Server documentation - About Netplan
    url: https://documentation.ubuntu.com/server/explanation/networking/about-netplan/
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R50)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-19
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R50
    relation: partial
    note: R50 covers every sensitive file; this control covers the netplan files.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-3
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-5(1)
    relation: related
threats:
  - framework: mitre-attack
    id: T1552.001
  - framework: cwe
    id: CWE-732
related_controls:
  - id: CB-UBU-NET-008
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot
    notes: "50-cloud-init.yaml 0644 on a fresh install, reported and fixed to 0600; not rewritten by cloud-init at reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot
    notes: "Passes on a fresh install (0600); still passes after remediation and reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot
    notes: "Passes on a fresh install (0600); a 0666 file is reported and fixed to 0600; kept after reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot
    notes: "Passes on a fresh install (0600); a 0666 file is reported and fixed to 0600; kept after reboot."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19