{ "id": "CB-UBU-SVC-025", "standard": "ubuntu", "version": "0.1.0", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-025", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-025.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-025.yml", "profiles_effective": [ "server-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-SVC-025", "title": "Confine services with systemd sandboxing options", "finding": { "title": "Network-facing services run with the full privileges systemd gives by default", "description": "A compromised service can read and change the whole system instead of its own files." }, "status": "active", "profiles": [ "server-hardened" ], "risk": { "severity": "medium" }, "assessment": "partial", "tags": [ "systemd", "sandboxing", "services", "least-privilege" ], "description": "systemd can confine each service with options in its unit or in a drop-in\n(`systemctl edit `): a dedicated or dynamic user (`User=`, `DynamicUser=`), a read-only\nview of the system (`ProtectSystem=strict`, `ProtectHome=`, `ReadWritePaths=`), a private `/tmp`\nand device set (`PrivateTmp=`, `PrivateDevices=`), no privilege gain\n(`NoNewPrivileges=`, `CapabilityBoundingSet=`), and kernel and system call filters\n(`ProtectKernelTunables=`, `RestrictAddressFamilies=`, `SystemCallFilter=`...).\n\n`systemd-analyze security` scores each service from 0 (confined) to 10 (unconfined) and labels\nit `OK`, `MEDIUM`, `EXPOSED` or `UNSAFE`.\n", "rationale": "Most daemons only need a few directories, capabilities and system calls. Confining them limits\nwhat an attacker gains by exploiting one: no access to other services' data, no kernel\ntuning, no new privileges. This is the compartmentalization ANSSI asks for each service.\n", "impact": "Options that are too strict make a service fail at start-up or at run time (cannot write its\nfiles, cannot open a socket). Each change must be tested on the service and kept in a drop-in so\npackage upgrades do not overwrite it.\n", "notes": "The check lists the services that `systemd-analyze security` labels `UNSAFE` with their score;\nit always passes, so the control ends as `review`. A person decides which network-facing\nservices to confine first. Many Ubuntu services already ship hardened units (for example\n`systemd-resolved`, `chrony`); OpenSSH stays largely unconfined by design, since it must start\nlogin sessions.\n\nThe options depend on the systemd version: 245 on 20.04, 249 on 22.04, 255 on 24.04, 259 on\n26.04. On 20.04, `ProtectProc=`, `ProcSubset=` (247) and `PrivateIPC=` (248) do not exist, and\nsystemd only logs a warning and ignores an unknown option, so check `systemd-analyze security\n` after each change instead of assuming the drop-in took effect. AppArmor profiles\n(`aa-status`) give a second confinement layer on Ubuntu and are not counted by this check.\n", "audit": { "manual": "1. Run `systemd-analyze security` and note the services rated `UNSAFE` or `EXPOSED`.\n2. For each service that listens on the network or parses untrusted data, check that a drop-in\n under `/etc/systemd/system/.d/` sets the sandboxing options it supports, and that\n `systemd-analyze security ` shows an improved score.\n", "checks": [ { "id": "exposure", "engine": "shell", "description": "Lists the services rated UNSAFE by systemd-analyze security, for review.", "spec": { "script": "command -v systemd-analyze >/dev/null 2>&1 || { echo \"systemd-analyze not found\"; exit 3; }\no=$(systemd-analyze security --no-pager 2>/dev/null) || { echo \"systemd-analyze security failed\"; exit 3; }\ntotal=$(printf '%s\\n' \"$o\" | awk 'NR > 1' | grep -c .)\nunsafe=$(printf '%s\\n' \"$o\" | awk 'NR > 1 && $3 == \"UNSAFE\" { printf \"%s=%s \", $1, $2 }')\nn=$(printf '%s' \"$unsafe\" | wc -w)\necho \"$n of $total services UNSAFE: $unsafe\"\n" } } ] }, "remediation": { "manual": "For each service to confine, run `systemctl edit ` and add the options it tolerates, for\nexample:\n```\n[Service]\nProtectSystem=strict\nReadWritePaths=/var/lib/\nProtectHome=yes\nPrivateTmp=yes\nPrivateDevices=yes\nNoNewPrivileges=yes\nProtectKernelTunables=yes\nProtectKernelModules=yes\nProtectControlGroups=yes\nRestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\n```\nRestart the service, check that it works and its logs (`journalctl -u `), then compare\n`systemd-analyze security `.\n", "rollback": "Run `systemctl revert ` to remove the drop-ins, then restart the service.\n" }, "references": [ { "title": "systemd.exec(5), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man5/systemd.exec.5.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "systemd-analyze(1), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man1/systemd-analyze.1.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R64, R65, R66)", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "anssi-linux", "framework_version": "2.0", "id": "R64", "relation": "partial", "note": "Covers service privileges through systemd users and capabilities." }, { "framework": "anssi-linux", "framework_version": "2.0", "id": "R65", "relation": "partial", "note": "Covers compartmentalization with systemd namespaces; containers and VMs are out of scope." }, { "framework": "anssi-linux", "framework_version": "2.0", "id": "R66", "relation": "partial", "note": "Covers system call and kernel access filters set by systemd." }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "SC-39", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-6", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1068" }, { "framework": "mitre-attack", "id": "T1190" }, { "framework": "cwe", "id": "CWE-250" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic", "notes": "Check lists the UNSAFE services from systemd-analyze security and ends as review, on fresh and loaded systems." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic", "notes": "Check lists the UNSAFE services from systemd-analyze security and ends as review, on fresh and loaded systems." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic", "notes": "Check lists the UNSAFE services from systemd-analyze security and ends as review, on fresh and loaded systems." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic", "notes": "Check lists the UNSAFE services from systemd-analyze security and ends as review, on fresh and loaded systems." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }