{
  "id": "CB-UBU-BOOT-015",
  "standard": "ubuntu",
  "version": "0.1.1",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-BOOT-015",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-BOOT-015.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-BOOT-015.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-BOOT-015",
    "title": "Disable automatic crash reporting (apport, whoopsie)",
    "finding": {
      "title": "Crashes are collected automatically and can be sent outside the organization",
      "description": "Apport keeps the memory of crashed programs in crash reports, and whoopsie can upload them to Canonical."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "core-dump",
      "apport",
      "privacy",
      "services"
    ],
    "description": "Apport is the crash reporting system of Ubuntu, installed by default on servers and desktops.\nWhen it runs, it registers itself as the kernel core dump handler (`kernel.core_pattern` set to\n`|/usr/share/apport/apport ...`) and turns `fs.suid_dumpable` to `2`. For every crash of a\npackaged program it writes a report to `/var/crash/` that holds the core dump, the command\nline, environment details and logs. Whoopsie, installed on desktops of some releases, and the\n`apport-autoreport` units upload these reports to Canonical's error tracker; `apport-forward`\nreceives crash data from containers.\n\nThis control sets `enabled=0` in `/etc/default/apport`, stops and masks the apport and whoopsie\nunits, and checks that `kernel.core_pattern` no longer points to apport.\n",
    "rationale": "Crash reports contain the memory of the process that crashed: passwords, keys, session tokens\nor personal data. They are stored on disk with broad readability for the user who crashed and\nfor administrators, and can be uploaded to a third party without a data processing agreement.\nWhile apport runs, it also overrides the core dump settings of CB-UBU-BOOT-005 and\nCB-UBU-BOOT-013.\n",
    "impact": "Crashes are no longer recorded in `/var/crash/` and no longer offered for reporting. Bugs can\nstill be reported by hand with `ubuntu-bug`, which does not need the service. On desktops, the\n\"problem reporting\" settings of GNOME have no effect anymore.\n",
    "notes": "Removing the package (`apt purge apport`) also meets the goal, but `ubuntu-server` and other\nmetapackages depend on it: disabling keeps the standard package set intact. When apport is\nstopped, it puts back `kernel.core_pattern = core` and `fs.suid_dumpable = 0`.\n",
    "setting": {
      "location": "/etc/default/apport; units apport.service, apport-forward.socket, apport-autoreport.path, apport-autoreport.timer, whoopsie.service, whoopsie.path",
      "default_value": "enabled=1, units enabled and running",
      "recommended_value": "enabled=0, units masked and stopped"
    },
    "audit": {
      "manual": "1. If apport is installed, `grep enabled /etc/default/apport` must show `enabled=0`.\n2. `systemctl is-enabled` must print `disabled` or `masked`, and `systemctl is-active` must not\n   print `active`, for each of these units that exists: `apport.service`,\n   `apport-forward.socket`, `apport-autoreport.path`, `apport-autoreport.timer`,\n   `whoopsie.service`, `whoopsie.path`.\n3. `cat /proc/sys/kernel/core_pattern` must not start with `|/usr/share/apport/`.\n",
      "checks": [
        {
          "id": "apport-config",
          "engine": "shell",
          "description": "Effective enabled= value in /etc/default/apport.",
          "facts": [
            "apport"
          ],
          "spec": {
            "script": "v=$(sed -n 's/^[[:space:]]*enabled[[:space:]]*=[[:space:]]*//p' /etc/default/apport 2>/dev/null | tail -n 1)\necho \"enabled=${v:-1 (default)}\"\n[ \"$v\" = 0 ]\n"
          }
        },
        {
          "id": "units",
          "engine": "shell",
          "description": "Crash reporting units are disabled or masked, and not running.",
          "spec": {
            "script": "rc=0\nfor u in apport.service apport-forward.socket apport-autoreport.path apport-autoreport.timer whoopsie.service whoopsie.path; do\n  e=$(systemctl is-enabled \"$u\" 2>/dev/null)\n  case $e in \"\" | not-found) continue ;; esac\n  a=$(systemctl is-active \"$u\" 2>/dev/null)\n  echo \"$u: $e, $a\"\n  case $e in disabled | masked | masked-runtime) ;; *) rc=1 ;; esac\n  [ \"$a\" = active ] && rc=1\ndone\nexit \"$rc\"\n"
          }
        },
        {
          "id": "core-pattern",
          "engine": "shell",
          "description": "kernel.core_pattern does not send core dumps to apport.",
          "spec": {
            "script": "p=$(cat /proc/sys/kernel/core_pattern) || exit 3\necho \"$p\"\ncase $p in \"|/usr/share/apport/\"*) exit 1 ;; esac\nexit 0\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. In `/etc/default/apport`, set `enabled=0`.\n2. Stop and mask the units that exist:\n   `systemctl mask --now apport.service apport-forward.socket apport-autoreport.path apport-autoreport.timer`,\n   and on desktops `systemctl mask --now whoopsie.service whoopsie.path`.\n3. Check that `/proc/sys/kernel/core_pattern` no longer starts with `|/usr/share/apport/`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Set `enabled=1` in `/etc/default/apport`, then `systemctl unmask` and `systemctl enable --now`\nthe units.\n",
      "scripts": [
        {
          "id": "disable",
          "engine": "shell",
          "file": "fix.sh"
        }
      ]
    },
    "references": [
      {
        "title": "apport-bug(1), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/apport-bug.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu Server documentation - How to report a bug in Ubuntu Server",
        "url": "https://documentation.ubuntu.com/server/how-to/software/report-a-bug/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu Security documentation - Dangerous sysctls (kernel.core_pattern, fs.suid_dumpable)",
        "url": "https://documentation.ubuntu.com/security/common-mistakes/dangerous-sysctls/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "core(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/core.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-11",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1003"
      },
      {
        "framework": "cwe",
        "id": "CWE-528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-BOOT-005",
        "type": "related"
      },
      {
        "id": "CB-UBU-BOOT-013",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot",
        "notes": "Fails on a fresh install (enabled=1, apport init script active, core_pattern piped to apport); fix masks the units, core_pattern back to core, suid_dumpable to 0; kept after reboot; fix idempotent."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot",
        "notes": "Fails on a fresh install (enabled=1, apport init script active, core_pattern piped to apport); fix masks the units, core_pattern back to core, suid_dumpable to 0; kept after reboot; fix idempotent."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot",
        "notes": "Fails on a fresh install (enabled=1, apport.service and its socket, path and timer enabled, core_pattern piped to apport); fix masks the units, core_pattern back to core, suid_dumpable to 0; kept after reboot; fix idempotent."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot",
        "notes": "Fails on a fresh install (enabled=1, apport.service and its socket, path and timer enabled, core_pattern piped to apport); fix masks the units, core_pattern back to core, suid_dumpable to 0; kept after reboot; fix idempotent."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}