Disable automatic crash reporting (apport, whoopsie)

Description

Apport is the crash reporting system of Ubuntu, installed by default on servers and desktops. When it runs, it registers itself as the kernel core dump handler (kernel.core_pattern set to |/usr/share/apport/apport ...) and turns fs.suid_dumpable to 2. For every crash of a packaged program it writes a report to /var/crash/ that holds the core dump, the command line, environment details and logs. Whoopsie, installed on desktops of some releases, and the apport-autoreport units upload these reports to Canonical's error tracker; apport-forward receives crash data from containers.

This control sets enabled=0 in /etc/default/apport, stops and masks the apport and whoopsie units, and checks that kernel.core_pattern no longer points to apport.

Removing the package (apt purge apport) also meets the goal, but ubuntu-server and other metapackages depend on it: disabling keeps the standard package set intact. When apport is stopped, it puts back kernel.core_pattern = core and fs.suid_dumpable = 0.

Rationale

Crash reports contain the memory of the process that crashed: passwords, keys, session tokens or personal data. They are stored on disk with broad readability for the user who crashed and for administrators, and can be uploaded to a third party without a data processing agreement. While apport runs, it also overrides the core dump settings of CB-UBU-BOOT-005 and CB-UBU-BOOT-013.

Impact

Crashes are no longer recorded in /var/crash/ and no longer offered for reporting. Bugs can still be reported by hand with ubuntu-bug, which does not need the service. On desktops, the "problem reporting" settings of GNOME have no effect anymore.

Setting

Audit

1. If apport is installed, grep enabled /etc/default/apport must show enabled=0.
2. systemctl is-enabled must print disabled or masked, and systemctl is-active must not print active, for each of these units that exists: apport.service, apport-forward.socket, apport-autoreport.path, apport-autoreport.timer, whoopsie.service, whoopsie.path.
3. cat /proc/sys/kernel/core_pattern must not start with |/usr/share/apport/.

Automated: every check must pass. Scanners report each check by its id.

apport-config

Effective enabled= value in /etc/default/apport.

script: |
  v=$(sed -n 's/^[[:space:]]*enabled[[:space:]]*=[[:space:]]*//p' /etc/default/apport 2>/dev/null | tail -n 1)
  echo "enabled=${v:-1 (default)}"
  [ "$v" = 0 ]

units

Crash reporting units are disabled or masked, and not running.

script: |
  rc=0
  for u in apport.service apport-forward.socket apport-autoreport.path apport-autoreport.timer whoopsie.service whoopsie.path; do
    e=$(systemctl is-enabled "$u" 2>/dev/null)
    case $e in "" | not-found) continue ;; esac
    a=$(systemctl is-active "$u" 2>/dev/null)
    echo "$u: $e, $a"
    case $e in disabled | masked | masked-runtime) ;; *) rc=1 ;; esac
    [ "$a" = active ] && rc=1
  done
  exit "$rc"

core-pattern

kernel.core_pattern does not send core dumps to apport.

script: |
  p=$(cat /proc/sys/kernel/core_pattern) || exit 3
  echo "$p"
  case $p in "|/usr/share/apport/"*) exit 1 ;; esac
  exit 0

Remediation

1. In /etc/default/apport, set enabled=0.
2. Stop and mask the units that exist: systemctl mask --now apport.service apport-forward.socket apport-autoreport.path apport-autoreport.timer, and on desktops systemctl mask --now whoopsie.service whoopsie.path.
3. Check that /proc/sys/kernel/core_pattern no longer starts with |/usr/share/apport/.

Rollback

Set enabled=1 in /etc/default/apport, then systemctl unmask and systemctl enable --now the units.

disable

# CB-UBU-BOOT-015: turn off apport and whoopsie. Idempotent.
f=/etc/default/apport
if [ -f "$f" ]; then
  if ! grep -Eq '^[[:space:]]*enabled[[:space:]]*=[[:space:]]*0[[:space:]]*$' "$f" ||
    grep -Eq '^[[:space:]]*enabled[[:space:]]*=[[:space:]]*[^0[:space:]]' "$f"; then
    cb_backup "$f"
    if grep -Eq '^[[:space:]]*enabled[[:space:]]*=' "$f"; then
      sed -i -E 's/^[[:space:]]*enabled[[:space:]]*=.*/enabled=0/' "$f"
    else
      printf '%s\n' 'enabled=0' >>"$f"
    fi
  fi
fi
# Stop and mask every crash reporting unit that exists. Stopping apport puts back
# kernel.core_pattern = core and fs.suid_dumpable = 0.
for u in apport-autoreport.timer apport-autoreport.path apport-forward.socket whoopsie.path whoopsie.service apport.service; do
  e=$(systemctl is-enabled "$u" 2>/dev/null)
  case $e in "" | not-found) continue ;; esac
  systemctl stop "$u" || exit 1
  [ "$e" = masked ] || systemctl mask "$u" || exit 1
done
case $(cat /proc/sys/kernel/core_pattern) in
  "|/usr/share/apport/"*) printf 'core\n' >/proc/sys/kernel/core_pattern ;;
esac

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• apport-bug(1), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Server documentation - How to report a bug in Ubuntu Server Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Security documentation - Dangerous sysctls (kernel.core_pattern, fs.suid_dumpable) Canonical, vendor-doc, accessed 2026-10-19
• core(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-BOOT-005 Disable core dumps of setuid programs
• related CB-UBU-BOOT-013 Disable core dumps

People and lifecycle