{
  "id": "CB-UBU-PKG-006",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-006",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-006.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-PKG-006.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-PKG-006",
    "title": "Configure the Ubuntu security pocket",
    "finding": {
      "title": "The Ubuntu security pocket is not configured",
      "description": "Security fixes are published in a separate pocket; without it the system never receives them."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "automated",
    "tags": [
      "apt",
      "repositories",
      "updates",
      "ubuntu-pro"
    ],
    "description": "The Ubuntu Security Team publishes fixes in the `<codename>-security` pocket (for example\n`noble-security`), served from `security.ubuntu.com/ubuntu` (`ports.ubuntu.com/ubuntu-ports`\nfor other architectures). Each Ubuntu release needs an enabled `deb` entry for this pocket, or\nfor an internal mirror of it.\n\nOn a system attached to Ubuntu Pro, the Expanded Security Maintenance (ESM) fixes for the\nmain and restricted components are published in the `<codename>-infra-security` pocket of\n`esm.ubuntu.com/infra/ubuntu`, which the Pro client adds when the `esm-infra` service is\nenabled. Attached systems must have it too.\n",
    "rationale": "Fixes reach the `<codename>-updates` pocket too, but only the security pocket is guaranteed to\ncarry every security fix as soon as it is published, and it is the one unattended-upgrades\ninstalls from. Without it, a system stays exposed to every published vulnerability, even if\nupdates are applied every day. Once a release leaves standard support (20.04 since May 2025),\nnew fixes for main and restricted are published in ESM only.\n",
    "impact": "None known. The system must reach the security mirror (and `esm.ubuntu.com` when attached to\nUbuntu Pro) or an internal copy of them.\n",
    "notes": "Configured by default on every release (`security.ubuntu.com` in `/etc/apt/sources.list` on\n20.04 and 22.04, in `/etc/apt/sources.list.d/ubuntu.sources` on 24.04 and later). The ESM\ncheck only applies to systems attached to Ubuntu Pro (fact `ubuntu-pro`); whether a system\nshould be attached is decided by CB-UBU-PKG-009 and CB-UBU-PKG-014. The `esm-apps` pocket is\nchecked by CB-UBU-PKG-014.\n",
    "setting": {
      "location": "/etc/apt/sources.list, /etc/apt/sources.list.d/",
      "default_value": "<codename>-security configured, no ESM pocket until attached to Ubuntu Pro",
      "recommended_value": "An enabled deb entry for the <codename>-security pocket, and for <codename>-infra-security when attached to Ubuntu Pro"
    },
    "audit": {
      "manual": "1. Run `apt-cache policy | grep -- '-security'`. It must list the `<codename>-security` pocket\n   of the installed release (`. /etc/os-release; echo \"$VERSION_CODENAME\"`).\n2. If `pro status` shows the system attached to Ubuntu Pro, it must also list\n   `<codename>-infra-security` from `esm.ubuntu.com`, and `pro status` must show `esm-infra`\n   enabled.\n",
      "checks": [
        {
          "id": "security-suite",
          "engine": "shell",
          "description": "Enabled deb entries for the security pocket of the installed release.",
          "spec": {
            "script": "c=$( (. /etc/os-release && printf '%s' \"${VERSION_CODENAME:-}\") 2>/dev/null)\n[ -n \"$c\" ] || { echo \"VERSION_CODENAME unknown in /etc/os-release\"; exit 3; }\nfiles=\nfor f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do\n  [ -f \"$f\" ] && files=\"$files $f\"\ndone\n[ -n \"$files\" ] || { echo \"no APT source file\"; exit 1; }\n# One line per entry: file:line, types, URIs, suites, ;option=value list (lowercase).\n# shellcheck disable=SC2086\nawk '\n  function flush() { if (st && en != \"no\") print src \"\\t\" ty \"\\t\" ur \"\\t\" su \"\\t\" op; st = 0; ty = ur = su = op = en = \"\" }\n  FNR == 1 { flush(); d = FILENAME ~ /\\.sources$/ }\n  !d {\n    sub(/#.*/, \"\"); if ($1 !~ /^deb(-src)?$/) next\n    l = $0; o = \"\"; i = index(l, \"[\"); j = index(l, \"]\")\n    if (i && j > i) { o = substr(l, i + 1, j - i - 1); l = substr(l, 1, i - 1) \" \" substr(l, j + 1) }\n    split(l, w, \" \"); gsub(/[ \\t]+/, \";\", o)\n    print FILENAME \":\" FNR \"\\t\" w[1] \"\\t\" w[2] \"\\t\" w[3] \"\\t;\" tolower(o); next\n  }\n  /^#/ { next }\n  /^[ \\t]*$/ { flush(); next }\n  /^[ \\t]/ { next }\n  {\n    if (!st) { st = 1; src = FILENAME \":\" FNR }\n    k = $0; sub(/:.*/, \"\", k); k = tolower(k); v = $0; sub(/^[^:]*:[ \\t]*/, \"\", v)\n    if (k == \"types\") ty = v; else if (k == \"uris\") ur = v; else if (k == \"suites\") su = v\n    else if (k == \"enabled\") en = tolower(v)\n    else op = op \";\" k \"=\" tolower(v == \"\" ? \"inline\" : v)\n  }\n  END { flush() }' $files | awk -F '\\t' -v s=\"$c-security\" '\n  {\n    nt = split($2, t, \" \"); ns = split($4, w, \" \"); deb = 0\n    for (i = 1; i <= nt; i++) if (t[i] == \"deb\") deb = 1\n    for (i = 1; i <= ns; i++) if (deb && w[i] == s) { print $1 \" \" $3 \" \" s; found = 1 }\n  }\n  END { if (!found) print \"no enabled deb entry for \" s; exit !found }'\n"
          }
        },
        {
          "id": "esm-infra-suite",
          "engine": "shell",
          "description": "Enabled deb entries for the ESM infra pocket, on systems attached to Ubuntu Pro.",
          "facts": [
            "ubuntu-pro"
          ],
          "spec": {
            "script": "c=$( (. /etc/os-release && printf '%s' \"${VERSION_CODENAME:-}\") 2>/dev/null)\n[ -n \"$c\" ] || { echo \"VERSION_CODENAME unknown in /etc/os-release\"; exit 3; }\nfiles=\nfor f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do\n  [ -f \"$f\" ] && files=\"$files $f\"\ndone\n[ -n \"$files\" ] || { echo \"no APT source file\"; exit 1; }\n# One line per entry: file:line, types, URIs, suites, ;option=value list (lowercase).\n# shellcheck disable=SC2086\nawk '\n  function flush() { if (st && en != \"no\") print src \"\\t\" ty \"\\t\" ur \"\\t\" su \"\\t\" op; st = 0; ty = ur = su = op = en = \"\" }\n  FNR == 1 { flush(); d = FILENAME ~ /\\.sources$/ }\n  !d {\n    sub(/#.*/, \"\"); if ($1 !~ /^deb(-src)?$/) next\n    l = $0; o = \"\"; i = index(l, \"[\"); j = index(l, \"]\")\n    if (i && j > i) { o = substr(l, i + 1, j - i - 1); l = substr(l, 1, i - 1) \" \" substr(l, j + 1) }\n    split(l, w, \" \"); gsub(/[ \\t]+/, \";\", o)\n    print FILENAME \":\" FNR \"\\t\" w[1] \"\\t\" w[2] \"\\t\" w[3] \"\\t;\" tolower(o); next\n  }\n  /^#/ { next }\n  /^[ \\t]*$/ { flush(); next }\n  /^[ \\t]/ { next }\n  {\n    if (!st) { st = 1; src = FILENAME \":\" FNR }\n    k = $0; sub(/:.*/, \"\", k); k = tolower(k); v = $0; sub(/^[^:]*:[ \\t]*/, \"\", v)\n    if (k == \"types\") ty = v; else if (k == \"uris\") ur = v; else if (k == \"suites\") su = v\n    else if (k == \"enabled\") en = tolower(v)\n    else op = op \";\" k \"=\" tolower(v == \"\" ? \"inline\" : v)\n  }\n  END { flush() }' $files | awk -F '\\t' -v s=\"$c-infra-security\" '\n  {\n    nt = split($2, t, \" \"); ns = split($4, w, \" \"); deb = 0\n    for (i = 1; i <= nt; i++) if (t[i] == \"deb\") deb = 1\n    for (i = 1; i <= ns; i++) if (deb && w[i] == s) { print $1 \" \" $3 \" \" s; found = 1 }\n  }\n  END { if (!found) print \"no enabled deb entry for \" s; exit !found }'\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Add the security pocket, for example in `/etc/apt/sources.list.d/ubuntu.sources` on 24.04\n   and later (replace `noble` with the codename of the installed release, or the URI with an\n   internal mirror):\n\n   ```\n   Types: deb\n   URIs: https://security.ubuntu.com/ubuntu\n   Suites: noble-security\n   Components: main universe restricted multiverse\n   Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n   ```\n\n   On 20.04 and 22.04, add to `/etc/apt/sources.list`:\n   `deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] https://security.ubuntu.com/ubuntu jammy-security main restricted universe multiverse`.\n2. On a system attached to Ubuntu Pro, run `pro enable esm-infra`: the Pro client writes the\n   ESM source entry and its key.\n3. Run `apt-get update`.\n"
    },
    "references": [
      {
        "title": "Ubuntu Server documentation - Package management",
        "url": "https://documentation.ubuntu.com/server/how-to/software/package-management/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu Pro Client - How to enable ESM Infra",
        "url": "https://documentation.ubuntu.com/pro-client/en/latest/howtoguides/enable_esm_infra/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Ubuntu - Expanded Security Maintenance",
        "url": "https://ubuntu.com/security/esm",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R61)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R61",
        "relation": "partial",
        "note": "R61 asks for regular security updates; receiving them first needs the security pocket."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-2",
        "relation": "partial"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1190"
      },
      {
        "framework": "cwe",
        "id": "CWE-1395"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-PKG-007",
        "type": "related"
      },
      {
        "id": "CB-UBU-PKG-008",
        "type": "related"
      },
      {
        "id": "CB-UBU-PKG-009",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on stock; fails with the security pocket disabled; ESM check not applicable when not attached, and with a shimmed attached Pro client fails without and passes with an esm-infra entry (no Pro token in the lab)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on stock; fails with the security pocket disabled; ESM check not applicable when not attached, and with a shimmed attached Pro client fails without and passes with an esm-infra entry (no Pro token in the lab)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on stock; fails with the security pocket disabled; ESM check not applicable when not attached, and with a shimmed attached Pro client fails without and passes with an esm-infra entry (no Pro token in the lab)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on stock; fails with the security pocket disabled; ESM check not applicable when not attached, and with a shimmed attached Pro client fails without and passes with an esm-infra entry (no Pro token in the lab)."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}