CINXE.COM

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"> <meta name="robots" content="index,nofollow"> <title>Security/Features - Ubuntu Wiki</title> <script type="text/javascript" src="/moin_static198/common/js/common.js"></script> <script type="text/javascript">  </script> <link rel="stylesheet" type="text/css" charset="utf-8" media="all" href="/moin_static198/light/css/common.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="screen" href="/moin_static198/light/css/screen.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="print" href="/moin_static198/light/css/print.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="projection" href="/moin_static198/light/css/projection.css">   <link rel="alternate" title="Ubuntu Wiki: Security/Features" href="/Security/Features?diffs=1&show_att=1&action=rss_rc&unique=0&page=Security%2FFeatures&ddiffs=1" type="application/rss+xml"> <link rel="Start" href="/Home"> <link rel="Alternate" title="Wiki Markup" href="/Security/Features?action=raw"> <link rel="Alternate" media="print" title="Print View" href="/Security/Features?action=print"> <link rel="Up" href="/Security"> <link rel="Search" href="/FindPage"> <link rel="Index" href="/TitleIndex"> <link rel="Glossary" href="/WordIndex"> <link rel="Help" href="/HelpOnFormatting"> </head> <body lang="en" dir="ltr">  <div id="wrapper" class="hfeed"> <div id="header"> <ul id="mothership"> <li> <a href="http://www.ubuntu.com/partners">Partners</a> </li> <li> <a href="http://www.ubuntu.com/support">Support</a> </li> <li> <a href="http://www.ubuntu.com/community">Community</a> </li> <li> <a href="http://www.ubuntu.com">Ubuntu.com</a> </li> </ul> <div id="orangeHeader"> <h1> <a href="/" title="Ubuntu Wiki">Ubuntu Wiki</a> </h1> <div id="search-box"> <form id="searchform" method="get" action="/Security/Features"> <div> <input type="hidden" name="action" value="fullsearch"> <input type="hidden" name="context" value="180"> <label for="searchinput">Search:</label> <input id="searchinput" type="text" name="value" value="" size="20" onfocus="searchFocus(this)" onblur="searchBlur(this)" onkeyup="searchChange(this)" onchange="searchChange(this)" alt="Search"> <input id="titlesearch" name="titlesearch" type="submit" value="Titles" alt="Search Titles"> <input id="fullsearch" name="fullsearch" type="submit" value="Text" alt="Search Full Text"> </div> </form> <script type="text/javascript">  </script> </div> </div> </div> <div id="wikinav"> <ul class="editbar"><li>Immutable Page</li><li><a class="nbinfo" href="/Security/Features?action=info" rel="nofollow">Info</a></li><li><a class="nbattachments" href="/Security/Features?action=AttachFile" rel="nofollow">Attachments</a></li><li> <form class="actionsmenu" method="GET" action="/Security/Features"> <div> <label>More Actions:</label> <select name="action" onchange="if ((this.selectedIndex != 0) && (this.options[this.selectedIndex].disabled == false)) { this.form.submit(); } this.selectedIndex = 0;"> <option value="raw">Raw Text</option> <option value="print">Print View</option> <option value="RenderAsDocbook">Render as Docbook</option> <option value="refresh">Delete Cache</option> <option value="show" disabled class="disabled">------------------------</option> <option value="SpellCheck">Check Spelling</option> <option value="LikePages">Like Pages</option> <option value="LocalSiteMap">Local Site Map</option> <option value="show" disabled class="disabled">------------------------</option> <option value="RenamePage" disabled class="disabled">Rename Page</option> <option value="CopyPage">Copy Page</option> <option value="DeletePage" disabled class="disabled">Delete Page</option> <option value="show" disabled class="disabled">------------------------</option> <option value="show" disabled class="disabled">Subscribe User</option> <option value="show" disabled class="disabled">------------------------</option> <option value="show" disabled class="disabled">Remove Spam</option> <option value="show" disabled class="disabled">Revert to this revision</option> <option value="PackagePages">Package Pages</option> <option value="SyncPages">Sync Pages</option> <option value="show" disabled class="disabled">------------------------</option> <option value="Load">Load</option> <option value="Save">Save</option> <option value="SlideShow">SlideShow</option> </select> <input type="submit" value="Do"> </div> <script type="text/javascript">  </script> </form> </li></ul> <ul id="username"> <li><a href="/Home">Ubuntu Wiki</a></li> <li><a href="?action=login">Login</a></li> <li><a href="/HelpContents">Help</a></li> </ul> <hr class="clearBoth" /> </div> <div id="main"> <div id="container"> <div id="content"> <h2 class="entry-title"> <a href="/Security/Features">Features</a> </h2> <div class="hentry post"> <div id="page" lang="en" dir="ltr"> <div dir="ltr" id="content" lang="en"> <div dir="ltr" id="SecurityTeam.2FHeader.content" lang="en"> <div><table style="&quot; width: 100%; background: #f1f1ed; color: black; &quot;"><tbody><tr> <td style="&quot; border-style: solid #ccc; border-width: 1px 0; &quot;"><a href="/SecurityTeam">Ubuntu Security Team</a> • <a href="/SecurityTeam/Roadmap">Roadmap</a> • <a href="/SecurityTeam/GettingInvolved">Getting Involved</a> • <a href="/SecurityTeam/KnowledgeBase">Knowledge Base</a> • <a href="/SecurityTeam/FAQ">FAQ</a> • <a href="/SecurityTeam/Contacts">Contacts</a> </td> </tr> </tbody></table></div></div> <h1 id="Matrix">Matrix</h1> <div><table><tbody><tr> <td style="background-color: #00dd00"> By Default </td> </tr> <tr> <td style="background-color: #98fd98"> Available </td> </tr> <tr> <td style="background-color: #dddddd"> Unimplemented </td> </tr> </tbody></table></div><div><table><tbody><tr> <td> feature </td> <td>20.04 LTS </td> <td>22.04 LTS </td> <td>24.04 LTS </td> <td>24.10 </td> <td>25.04 </td> </tr> <tr> <td> <a href="/Security/Features#ports">No Open Ports</a> </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> </tr> <tr> <td> <a href="/Security/Features#hashing">Password hashing</a> </td> <td style="background-color: #00dd00"> sha512 </td> <td style="background-color: #00dd00"> yescrypt </td> <td style="background-color: #00dd00"> yescrypt </td> <td style="background-color: #00dd00"> yescrypt </td> <td style="background-color: #00dd00"> yescrypt </td> </tr> <tr> <td> <a href="/Security/Features#syn-cookies">SYN cookies</a> </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> </tr> <tr> <td> <a href="/Security/Features#unattended-upgrades">Automatic security updates</a> </td> <td style="background-color: #00dd00"> enabled </td> <td style="background-color: #00dd00"> enabled </td> <td style="background-color: #00dd00"> enabled </td> <td style="background-color: #00dd00"> enabled </td> <td style="background-color: #00dd00"> enabled </td> </tr> <tr> <td> <a href="/Security/Features#kernel-livepatches">Kernel Livepatches</a> </td> <td style="background-color: #98fd98"> 20.04 LTS Kernel </td> <td style="background-color: #98fd98"> 22.04 LTS Kernel </td> <td style="background-color: #98fd98"> 24.04 LTS Kernel </td> <td style="background-color: #dddddd"> -- </td> <td style="background-color: #dddddd"> -- </td> </tr> <tr> <td> <a href="/Security/Features#disable-legacy-tls">Disable legacy TLS</a> </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> <td style="background-color: #00dd00"> policy </td> </tr> <tr> <td> <a href="/Security/Features#fscaps">Filesystem Capabilities</a> </td> <td style="background-color: #00dd00"> kernel & userspace (default on server) </td> <td style="background-color: #00dd00"> kernel & userspace (default on server) </td> <td style="background-color: #00dd00"> kernel & userspace (default on server) </td> <td style="background-color: #00dd00"> kernel & userspace (default on server) </td> <td style="background-color: #00dd00"> kernel & userspace (default on server) </td> </tr> <tr> <td> <a href="/Security/Features#firewall">Configurable Firewall</a> </td> <td style="background-color: #00dd00"> ufw </td> <td style="background-color: #00dd00"> ufw </td> <td style="background-color: #00dd00"> ufw </td> <td style="background-color: #00dd00"> ufw </td> <td style="background-color: #00dd00"> ufw </td> </tr> <tr> <td> <a href="/Security/Features#prng-cloud">Cloud PRNG seed</a> </td> <td style="background-color: #00dd00"> pollinate </td> <td style="background-color: #00dd00"> pollinate </td> <td style="background-color: #00dd00"> pollinate </td> <td style="background-color: #00dd00"> pollinate </td> <td style="background-color: #00dd00"> pollinate </td> </tr> <tr> <td> <a href="/Security/Features#seccomp">PR_SET_SECCOMP</a> </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#apparmor">AppArmor</a> </td> <td style="background-color: #00dd00"> 2.13.3 </td> <td style="background-color: #00dd00"> 3.0.4 </td> <td style="background-color: #00dd00"> 3.0.7 </td> <td style="background-color: #00dd00"> 3.0.7 </td> <td style="background-color: #00dd00"> 3.0.7 </td> </tr> <tr> <td> <a href="/Security/Features#apparmor-unprivileged-userns-restrictions">AppArmor unprivileged user namespace restrictions</a> </td> <td style="background-color: #dddddd"> -- </td> <td style="background-color: #dddddd"> -- </td> <td style="background-color: #00dd00"> kernel & userspace </td> <td style="background-color: #00dd00"> kernel & userspace </td> <td style="background-color: #00dd00"> kernel & userspace </td> </tr> <tr> <td> <a href="/Security/Features#selinux">SELinux</a> </td> <td style="background-color: #98fd98"> universe </td> <td style="background-color: #98fd98"> universe </td> <td style="background-color: #98fd98"> universe </td> <td style="background-color: #98fd98"> universe </td> <td style="background-color: #98fd98"> universe </td> </tr> <tr> <td> <a href="/Security/Features#smack">SMACK</a> </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#encrypted-lvm">Encrypted LVM</a> </td> <td style="background-color: #98fd98"> main installer </td> <td style="background-color: #98fd98"> main installer </td> <td style="background-color: #98fd98"> main installer </td> <td style="background-color: #98fd98"> main installer </td> <td style="background-color: #98fd98"> main installer </td> </tr> <tr> <td> <a href="/Security/Features#encrypted-files">File Encryption</a> </td> <td style="background-color: #98fd98"> ZFS dataset encryption available, encrypted Home (eCryptfs) and ext4 encryption (fscrypt) available in universe </td> <td style="background-color: #98fd98"> ZFS dataset encryption available, encrypted Home (eCryptfs) and ext4 encryption (fscrypt) available in universe </td> <td style="background-color: #98fd98"> ZFS dataset encryption available, encrypted Home (eCryptfs) and ext4 encryption (fscrypt) available in universe </td> <td style="background-color: #98fd98"> ZFS dataset encryption available, encrypted Home (eCryptfs) and ext4 encryption (fscrypt) available in universe </td> <td style="background-color: #98fd98"> ZFS dataset encryption available, encrypted Home (eCryptfs) and ext4 encryption (fscrypt) available in universe </td> </tr> <tr> <td> <a href="/Security/Features#TPM">Trusted Platform Module</a> </td> <td style="background-color: #98fd98"> kernel & userspace (tpm-tools) </td> <td style="background-color: #98fd98"> kernel & userspace (tpm-tools) </td> <td style="background-color: #98fd98"> kernel & userspace (tpm-tools) </td> <td style="background-color: #98fd98"> kernel & userspace (tpm-tools) </td> <td style="background-color: #98fd98"> kernel & userspace (tpm-tools) </td> </tr> <tr> <td> <a href="/Security/Features#stack-protector">Stack Protector</a> </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> </tr> <tr> <td> <a href="/Security/Features#heap-protector">Heap Protector</a> </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> </tr> <tr> <td> <a href="/Security/Features#pointer-obfuscation">Pointer Obfuscation</a> </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> <td style="background-color: #00dd00"> glibc </td> </tr> <tr> <td> <a href="/Security/Features#stack-aslr">Stack ASLR</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#mmap-aslr">Libs/mmap ASLR</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#exec-aslr">Exec ASLR</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#brk-aslr">brk ASLR</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#vdso-aslr">VDSO ASLR</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#pie">Built as PIE</a> </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> </tr> <tr> <td> <a href="/Security/Features#fortify-source">Built with Fortify Source</a> </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> </tr> <tr> <td> <a href="/Security/Features#relro">Built with RELRO</a> </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> <td style="background-color: #00dd00"> gcc patch </td> </tr> <tr> <td> <a href="/Security/Features#bindnow">Built with BIND_NOW</a> </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> <td style="background-color: #00dd00"> gcc patch (amd64, ppc64el, s390x), package list for others </td> </tr> <tr> <td> <a href="/Security/Features#stack-clash-protection">Built with -fstack-clash-protection</a> </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64, ppc64el, s390x) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64, ppc64el, s390x) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64, ppc64el, s390x) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64, ppc64el, s390x) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64, ppc64el, s390x) </td> </tr> <tr> <td> <a href="/Security/Features#cf-protection">Built with -fcf-protection</a> </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64) </td> <td style="background-color: #00dd00"> gcc patch (i386, amd64) </td> </tr> <tr> <td> <a href="/Security/Features#nx">Non-Executable Memory</a> </td> <td style="background-color: #00dd00"> PAE, ia32 partial-NX-emulation </td> <td style="background-color: #00dd00"> PAE, ia32 partial-NX-emulation </td> <td style="background-color: #00dd00"> PAE, ia32 partial-NX-emulation </td> <td style="background-color: #00dd00"> PAE, ia32 partial-NX-emulation </td> <td style="background-color: #00dd00"> PAE, ia32 partial-NX-emulation </td> </tr> <tr> <td> <a href="/Security/Features#proc-maps">/proc/$pid/maps protection</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#symlink">Symlink restrictions</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#hardlink">Hardlink restrictions</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#protected-fifos">FIFO restrictions</a> </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> </tr> <tr> <td> <a href="/Security/Features#protected-regular">Regular file restrictions</a> </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> <td style="background-color: #00dd00"> kernel & sysctl </td> </tr> <tr> <td> <a href="/Security/Features#ptrace">ptrace scope</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#null-mmap">0-address protection</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#dev-mem">/dev/mem protection</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#dev-kmem">/dev/kmem disabled</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#block-modules">Block module loading</a> </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> </tr> <tr> <td> <a href="/Security/Features#rodata">Read-only data sections</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#kernel-stack-protector">Stack protector</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#module-ronx">Module RO/NX</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#kptr-restrict">Kernel Address Display Restriction</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#kASLR">Kernel Address Space Layout Randomisation</a> </td> <td style="background-color: #00dd00"> kernel (i386, amd64, arm64, and s390 only) </td> <td style="background-color: #00dd00"> kernel (i386, amd64, arm64, and s390 only) </td> <td style="background-color: #00dd00"> kernel (i386, amd64, arm64, and s390 only) </td> <td style="background-color: #00dd00"> kernel (i386, amd64, arm64, and s390 only) </td> <td style="background-color: #00dd00"> kernel (i386, amd64, arm64, and s390 only) </td> </tr> <tr> <td> <a href="/Security/Features#denylist-rare-net">Denylist Rare Protocols</a> </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#seccomp-filter">Syscall Filtering</a> </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> <td style="background-color: #98fd98"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#dmesg-restrict">dmesg restrictions</a> </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> <td style="background-color: #00dd00"> kernel </td> </tr> <tr> <td> <a href="/Security/Features#kexec">Block kexec</a> </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> <td style="background-color: #98fd98"> sysctl </td> </tr> <tr> <td> <a href="/Security/Features#secure-boot">UEFI Secure Boot (amd64)</a> </td> <td style="background-color: #00dd00"> amd64, kernel signature enforcement </td> <td style="background-color: #00dd00"> amd64, kernel signature enforcement </td> <td style="background-color: #00dd00"> amd64, kernel signature enforcement </td> <td style="background-color: #00dd00"> amd64, kernel signature enforcement </td> <td style="background-color: #00dd00"> amd64, kernel signature enforcement </td> </tr> <tr> <td> <a href="/Security/Features#usbguard">usbguard</a> </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> </tr> <tr> <td> <a href="/Security/Features#usbauth">usbauth</a> </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> </tr> <tr> <td> <a href="/Security/Features#bolt">bolt</a> </td> <td style="background-color: #00dd00"> kernel & userspace </td> <td style="background-color: #00dd00"> kernel & userspace </td> <td style="background-color: #00dd00"> kernel & userspace </td> <td style="background-color: #00dd00"> kernel & userspace </td> <td style="background-color: #00dd00"> kernel & userspace </td> </tr> <tr> <td> <a href="/Security/Features#thunderbolt-tools">thunderbolt-tools</a> </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> <td style="background-color: #98fd98"> kernel & userspace </td> </tr> <tr> <td> <a href="/Security/Features#kernel-lockdown">Kernel Lockdown</a> </td> <td style="background-color: #00dd00"> integrity only, no confidentiality </td> <td style="background-color: #00dd00"> integrity only, no confidentiality </td> <td style="background-color: #00dd00"> integrity only, no confidentiality </td> <td style="background-color: #00dd00"> integrity only, no confidentiality </td> <td style="background-color: #00dd00"> integrity only, no confidentiality </td> </tr> </tbody></table></div><div><table style="&quot; float:right; font-size: 0.9em; width:30%; background:#F1F1ED; background-repeat: no-repeat; background-position: 98% 0.5ex; margin: 0 0 1em 1em; padding: 0.5em; &quot;"><tbody><tr> <td><div class="table-of-contents">Contents<ol><li> <a href="#Matrix">Matrix</a></li><li> <a href="#Features">Features</a><ol><li> <a href="#Configuration">Configuration</a><ol><li> <a href="#No_Open_Ports">No Open Ports</a></li><li> <a href="#Password_hashing">Password hashing</a></li><li> <a href="#SYN_cookies">SYN cookies</a></li><li> <a href="#Automatic_security_updates">Automatic security updates</a></li><li> <a href="#Kernel_Livepatches">Kernel Livepatches</a></li><li> <a href="#Disable_legacy_TLS">Disable legacy TLS</a></li></ol></li><li> <a href="#Subsystems">Subsystems</a><ol><li> <a href="#Filesystem_Capabilities">Filesystem Capabilities</a></li><li> <a href="#Configurable_Firewall">Configurable Firewall</a></li><li> <a href="#Cloud_PRNG_seed">Cloud PRNG seed</a></li><li> <a href="#PR_SET_SECCOMP">PR_SET_SECCOMP</a></li></ol></li><li> <a href="#Mandatory_Access_Control_.28MAC.29">Mandatory Access Control (MAC)</a><ol><li> <a href="#AppArmor">AppArmor</a></li><li> <a href="#AppArmor_unprivileged_user_namespace_restrictions">AppArmor unprivileged user namespace restrictions</a></li><li> <a href="#SELinux">SELinux</a></li><li> <a href="#SMACK">SMACK</a></li></ol></li><li> <a href="#Storage_Encryption">Storage Encryption</a><ol><li> <a href="#Encrypted_LVM">Encrypted LVM</a></li><li> <a href="#File_Encryption">File Encryption</a></li></ol></li><li> <a href="#Trusted_Platform_Module">Trusted Platform Module</a></li><li> <a href="#Userspace_Hardening">Userspace Hardening</a><ol><li> <a href="#Stack_Protector">Stack Protector</a></li><li> <a href="#Heap_Protector">Heap Protector</a></li><li> <a href="#Pointer_Obfuscation">Pointer Obfuscation</a></li><li> <a href="#Address_Space_Layout_Randomisation_.28ASLR.29">Address Space Layout Randomisation (ASLR)</a><ol><li> <a href="#Stack_ASLR">Stack ASLR</a></li><li> <a href="#Libs.2Fmmap_ASLR">Libs/mmap ASLR</a></li><li> <a href="#Exec_ASLR">Exec ASLR</a></li><li> <a href="#brk_ASLR">brk ASLR</a></li><li> <a href="#VDSO_ASLR">VDSO ASLR</a></li></ol></li><li> <a href="#Built_as_PIE">Built as PIE</a></li><li> <a href="#Built_with_Fortify_Source">Built with Fortify Source</a></li><li> <a href="#Built_with_RELRO">Built with RELRO</a></li><li> <a href="#Built_with_BIND_NOW">Built with BIND_NOW</a></li><li> <a href="#Built_with_-fstack-clash-protection">Built with -fstack-clash-protection</a></li><li> <a href="#Built_with_-fcf-protection">Built with -fcf-protection</a></li><li> <a href="#Non-Executable_Memory">Non-Executable Memory</a></li><li> <a href="#A.2Fproc.2F.24pid.2Fmaps_protection">/proc/$pid/maps protection</a></li><li> <a href="#Symlink_restrictions">Symlink restrictions</a></li><li> <a href="#Hardlink_restrictions">Hardlink restrictions</a></li><li> <a href="#FIFO_restrictions">FIFO restrictions</a></li><li> <a href="#Regular_file_restrictions">Regular file restrictions</a></li><li> <a href="#ptrace_scope">ptrace scope</a></li></ol></li><li> <a href="#Kernel_Hardening">Kernel Hardening</a><ol><li> <a href="#A0-address_protection">0-address protection</a></li><li> <a href="#A.2Fdev.2Fmem_protection">/dev/mem protection</a></li><li> <a href="#A.2Fdev.2Fkmem_disabled">/dev/kmem disabled</a></li><li> <a href="#Block_module_loading">Block module loading</a></li><li> <a href="#Read-only_data_sections">Read-only data sections</a></li><li> <a href="#Stack_protector">Stack protector</a></li><li> <a href="#Module_RO.2FNX">Module RO/NX</a></li><li> <a href="#Kernel_Address_Display_Restriction">Kernel Address Display Restriction</a></li><li> <a href="#Kernel_Address_Space_Layout_Randomisation">Kernel Address Space Layout Randomisation</a></li><li> <a href="#Denylist_Rare_Protocols">Denylist Rare Protocols</a></li><li> <a href="#Syscall_Filtering">Syscall Filtering</a></li><li> <a href="#dmesg_restrictions">dmesg restrictions</a></li><li> <a href="#Block_kexec">Block kexec</a></li><li> <a href="#UEFI_Secure_Boot_.28amd64.29">UEFI Secure Boot (amd64)</a></li><li> <a href="#usbguard">usbguard</a></li><li> <a href="#usbauth">usbauth</a></li><li> <a href="#bolt">bolt</a></li><li> <a href="#thunderbolt-tools">thunderbolt-tools</a></li><li> <a href="#Kernel_Lockdown">Kernel Lockdown</a></li></ol></li></ol></li><li> <a href="#Additional_Documentation">Additional Documentation</a></li></ol></div></td> </tr> </tbody></table></div> <h1 id="Features">Features</h1> <h2 id="Configuration">Configuration</h2> <h3 id="No_Open_Ports">No Open Ports</h3> <div dir="ltr" id="SecurityTeam.2FPolicies.content" lang="en"> Default installations of Ubuntu must have no listening network services after initial install. Exceptions to this rule on desktop systems include network infrastructure services such as a DHCP client and mDNS (Avahi/ZeroConf, see <a href="/ZeroConfPolicySpec">ZeroConfPolicySpec</a> for implementation details and justification). For Ubuntu in the cloud, exceptions include network infrastructure services for the cloud and OpenSSH running with client public key and port access configured by the cloud provider. When installing Ubuntu Server, the administrator can, of course, select specific services to install beyond the defaults (e.g. Apache). </div> Testing for this can be done with <tt class="backtick">netstat -an --inet | grep LISTEN | grep -v 127.0.0.1:</tt> on a fresh install. <h3 id="Password_hashing">Password hashing</h3> The system password used for logging into Ubuntu is stored in /etc/shadow. Very old style password hashes were based on DES and visible in /etc/passwd. Modern Linux has long since moved to /etc/shadow, and for some time now has used salted MD5-based hashes for password verification (crypt id 1). Since MD5 is considered "broken" for some uses and as computational power available to perform brute-forcing of MD5 increases, Ubuntu 8.10 and later proactively moved to using salted SHA-512 based password hashes (crypt id 6), which are orders of magnitude more difficult to brute-force. Ubuntu 22.04 LTS and later then moved to yescrypt to provide increased protection against offline password cracking. See the <a class="interwiki" href="http://manpages.ubuntu.com/crypt" title="Manpage">crypt</a> manpage for additional details. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-glibc-security.py">test-glibc-security.py</a> for regression tests. <h3 id="SYN_cookies">SYN cookies</h3> When a system is overwhelmed by new network connections, SYN cookie use is activated, which helps mitigate a SYN-flood attack. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h3 id="Automatic_security_updates">Automatic security updates</h3> Starting with Ubuntu 16.04 LTS, unattended-upgrades is configured to automatically apply security updates daily. Earlier Ubuntu releases can be <a class="https" href="https://help.ubuntu.com/14.04/serverguide/automatic-updates.html">configured</a> to automatically apply security updates. <h3 id="Kernel_Livepatches">Kernel Livepatches</h3> The <a class="https" href="https://www.ubuntu.com/server/livepatch">Canonical Livepatch service</a> provides security fixes for most major kernel security issues without requiring a reboot. Ubuntu users can take advantage of the service on up to three nodes for free. All machines covered by an Ubuntu Advantage support subscription are able to receive livepatches. <h3 id="Disable_legacy_TLS">Disable legacy TLS</h3> Legacy versions of the Transport Layer Security protocol including SSL 3.0, TLS 1.0 and TLS 1.1, have several inherent vulnerabilities and cannot provide the advertised level of security. For that Ubuntu 20.04 and later proactively disable these versions setting the bar of secure communication to protocols that are considered secure today. To communicate with legacy systems it is possible to re-enable the protocols. See <a class="https" href="https://discourse.ubuntu.com/t/default-to-tls-v1-2-in-all-tls-libraries-in-20-04-lts/12464/8">this discourse article</a> for more information. <h2 id="Subsystems">Subsystems</h2> <h3 id="Filesystem_Capabilities">Filesystem Capabilities</h3> The need for setuid applications can be reduced via the application of <a class="http" href="http://www.olafdietsche.de/linux/capability/">filesystem capabilities</a> using the xattrs available to most modern filesystems. This reduces the possible misuse of vulnerable setuid applications. The kernel provides the support, and the user-space tools are in main ("libcap2-bin"). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h3 id="Configurable_Firewall">Configurable Firewall</h3> <a href="/UbuntuFirewall">ufw</a> is a frontend for iptables, and is installed by default in Ubuntu (users must explicitly enable it). Particularly well-suited for host-based firewalls, ufw provides a framework for managing a netfilter firewall, as well as a command-line interface for manipulating the firewall. ufw aims to provide an easy to use interface for people unfamiliar with firewall concepts, while at the same time simplifies complicated iptables commands to help an administrator who knows what he or she is doing. ufw is an upstream for other distributions and graphical frontends. See <a class="https" href="https://bazaar.launchpad.net/~jdstrand/ufw/trunk/files">ufw tests</a> for regression tests. <h3 id="Cloud_PRNG_seed">Cloud PRNG seed</h3> <a class="https" href="https://bazaar.launchpad.net/~kirkland/pollen/trunk/view/head:/README">Pollinate</a> is a client application that retrieves entropy from one or more Pollen servers and seeds the local Pseudo Random Number Generator (PRNG). Pollinate is designed to adequately and securely seed the PRNG through communications with a Pollen server which is particularly important for systems operating in cloud environments. Starting with Ubuntu 14.04 LTS, Ubuntu cloud images include the Pollinate client, which will try to seed the PRNG with input from <a class="https" href="https://entropy.ubuntu.com">https://entropy.ubuntu.com</a> for up to 3 seconds on first boot. See <a class="https" href="https://bazaar.launchpad.net/~kirkland/pollen/trunk/view/head:/pollen_test.go">pollen_test.go</a> for regression tests <h3 id="PR_SET_SECCOMP">PR_SET_SECCOMP</h3> Setting <a class="https" href="https://lwn.net/Articles/332974/">SECCOMP</a> for a process is meant to confine it to a small subsystem of system calls, used for specialized processing-only programs. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h2 id="Mandatory_Access_Control_.28MAC.29">Mandatory Access Control (MAC)</h2> Mandatory Access Controls are handled via the kernel LSM hooks. <h3 id="AppArmor">AppArmor</h3> <a class="https" href="https://help.ubuntu.com/community/AppArmor">AppArmor</a> is a path-based MAC. It can mediate: <ul><li>file access (read, write, link, lock) </li><li>library loading </li><li>execution of applications </li><li>coarse-grained network (protocol, type, domain) </li><li>capabilities </li><li>coarse owner checks (task must have the same euid/fsuid as the object being checked) starting with Ubuntu 9.10 </li><li>mount starting with Ubuntu 12.04 LTS </li><li>unix(7) named sockets starting with Ubuntu 13.10 </li><li>DBus API (path, interface, method) starting with Ubuntu 13.10 </li><li>signal(7) starting with Ubuntu 14.04 LTS </li><li>ptrace(2) starting with Ubuntu 14.04 LTS </li><li>unix(7) abstract and anonymous sockets starting with Ubuntu 14.10 </li></ul><a href="/AppArmor">AppArmor</a> is a core technology for application confinement for <a class="https" href="https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement">Ubuntu Touch</a> and <a class="https" href="https://developer.ubuntu.com/en/snappy/guides/security-policy/">Snappy for Ubuntu Core and Personal</a>. Example profiles are found in the apparmor-profiles package from universe, and by-default shipped <a href="/SecurityTeam/KnowledgeBase/AppArmorProfiles">enforcing profiles</a> are being built up: <div dir="ltr" id="SecurityTeam.2FKnowledgeBase.2FAppArmorProfiles.content" lang="en"> <div><table><tbody><tr> <td> Source package/binary </td> <td> 12.04 LTS </td> <td> 14.04 LTS </td> <td> 16.04 LTS </td> <td> 18.04 LTS </td> <td> 20.04 LTS </td> <td> 20.10 </td> </tr> <tr> <td> Akonadi (mysqld) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Apache (apache2) </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Bind (named) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> ClamAV (clamd,freshclam) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Cups (cupsd) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Evince </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Firefox (firefox-3.5/firefox) </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> gdm-guest-session </td> <td> N/A </td> <td> N/A </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> ISC Dhcpd (dhcpd3/dhcpd) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> ISC Dhcp client (dhclient3/dhclient) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> juju </td> <td> yes2 </td> <td> yes2 </td> <td> yes2 </td> <td> yes2 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Libvirt (libvirtd and kvm/qemu guests) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Lightdm guest session </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> LXC </td> <td> yes3 </td> <td> yes3 </td> <td> yes3 </td> <td> yes3 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> MAAS dhcpd (dhcpd) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> MySQL (mysqld) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> NTP (ntpd) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> OpenLDAP (slapd) </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> quassel-core </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> rsyslog </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> tcpdump </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Telepathy </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> <a href="/AppStore">AppStore</a> apps (click)4 </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> Cups filters (cups-browsed) </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> lightdm-remote-session-freerdp </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> lightdm-remote-session-uccsconfigure </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> media-hub </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> mediascanner2 </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> squid3 </td> <td> -- </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> sssd </td> <td> -- </td> <td> yes1 </td> <td> yes1 </td> <td> yes1 </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> StrongSwan (stroke/lookip) </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> Telepathy (ofono) </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> <a href="/AppStore">AppStore</a> apps (snappy)5 </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> libvirt (libvirt-lxc containers) </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> LXD </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> snap-confine (aka ubuntu-core-launcher) </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> ubuntu-download-manager (extractor) </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> webbrowser-app </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> -- </td> <td> -- </td> <td> -- </td> </tr> <tr> <td> chrony </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> ippusbxd </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> libreoffice6 </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> man-db </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> mozc </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> yes </td> <td> yes </td> <td> yes </td> </tr> <tr> <td> anope </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> -- </td> <td> yes </td> </tr> </tbody></table></div><ol type="0"><li>Disabled by default and be opt-in for advanced users </li><li><a class="https" href="https://juju.ubuntu.com/AppArmor">https://juju.ubuntu.com/AppArmor</a> </li><li>Preliminary support </li><li>Ubuntu Touch apps in the Ubuntu <a href="/AppStore">AppStore</a> are confined with <a href="/AppArmor">AppArmor</a> by default. See <a class="https" href="https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement">ApplicationConfinement</a> for details </li><li>Apps in the Ubuntu <a href="/AppStore">AppStore</a> are confined with <a href="/AppArmor">AppArmor</a> by default. See the <a class="https" href="https://developer.ubuntu.com/en/snappy/guides/security-policy/">security guide</a> for details </li><li>Mixture of enforce and complain mode profiles </li></ol></div> Starting with Ubuntu 16.10, <a href="/AppArmor">AppArmor</a> can "stack" profiles so that the mediation decisions are made using the intersection of multiple profiles. This feature, combined with <a href="/AppArmor">AppArmor</a> profile namespaces, allows <a class="https" href="https://linuxcontainers.org/lxd/">LXD</a> to define a profile that an entire container will be confined with while still allowing individual, containerized processes to be further confined with profiles loaded inside of the container environment. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-apparmor.py">test-apparmor.py</a> and <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="AppArmor_unprivileged_user_namespace_restrictions">AppArmor unprivileged user namespace restrictions</h3> Starting with Ubuntu 23.10, <a href="/AppArmor">AppArmor</a> provides support for denying unprivileged applications the use of user namespaces. This prevents an unprivileged application from making use of a user namespace to gain access to additional capabilities and various kernel subsystems which present an additional attack surface. Applications which do require legitimate unprivileged access to user namespaces are designated by an appropriate <a href="/AppArmor">AppArmor</a> profile. Starting with Ubuntu 24.04 this is enabled by default. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-apparmor.py">test-apparmor.py</a> for regression tests. <h3 id="SELinux">SELinux</h3> <a href="/SELinux">SELinux</a> is an inode-based MAC. Targeted policies are available for Ubuntu in universe. Installing the "selinux" package will make the boot-time adjustments that are needed. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h3 id="SMACK">SMACK</h3> SMACK is a flexible inode-based MAC. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h2 id="Storage_Encryption">Storage Encryption</h2> <h3 id="Encrypted_LVM">Encrypted LVM</h3> Ubuntu 12.10 and newer include the ability to install Ubuntu onto an encrypted LVM, which allows all partitions in the logical volume, including swap, to be encrypted. Between 6.06 LTS and 12.04 LTS the alternate installer can install to an encrypted LVM. <h3 id="File_Encryption">File Encryption</h3> Encrypted Private Directories were implemented, utilizing <a class="https" href="https://ecryptfs.org/">eCryptfs</a>, in Ubuntu 8.10 as a secure location for users to store sensitive information. The server and alternate installers had the option to setup an encrypted private directory for the first user. In Ubuntu 9.04, support for encrypted home and filename encryption was added. Encrypted Home allowed users to encrypt all files in their home directory and was supported in the Alternate Installer and also in the Desktop Installer via the preseed option <tt class="backtick">user-setup/encrypt-home=true</tt>. Official support for Encrypted Private and Encrypted Home directories was dropped in Ubuntu 18.04 LTS. It is still possible to configure an encrypted private or home directory, after Ubuntu is installed, with the <tt class="backtick">ecryptfs-setup-private</tt> utility provided by the <tt class="backtick">ecryptfs-utils</tt> package. Starting in Ubuntu 18.04 LTS, it is also possible to install and use <a class="https" href="https://github.com/google/fscrypt">fscrypt</a> to encrypt directories on ext4 filesystems. Note that fscrypt is not officially supported but is available via the fscrypt package in universe. <h2 id="Trusted_Platform_Module">Trusted Platform Module</h2> TPM 1.2 support was added in Ubuntu 7.10. "tpm-tools" and related libraries are available in Ubuntu universe. For TPM 2.0, tpm2-tools is available in Ubuntu universe. <h2 id="Userspace_Hardening">Userspace Hardening</h2> Many security features are available through the default <a href="/CompilerFlags">compiler flags</a> used to build packages and through the kernel in Ubuntu. Note: Ubuntu's compiler hardening applies not only to its official builds but also anything built on Ubuntu using its compiler. <h3 id="Stack_Protector">Stack Protector</h3> gcc's -fstack-protector provides a randomized stack canary that protects against stack overflows, and reduces the chances of arbitrary code execution via controlling return address destinations. Enabled at compile-time. (A small number of applications do not play well with it, and have it disabled.) The routines used for stack checking are actually part of glibc, but gcc is patched to enable linking against those routines by default. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-gcc-security.py">test-gcc-security.py</a> for regression tests. <h3 id="Heap_Protector">Heap Protector</h3> The GNU C Library heap protector (both automatic via <a class="http" href="http://www.malloc.de/en/">ptmalloc</a> and <a class="https" href="https://www.gnu.org/s/libc/manual/html_node/Heap-Consistency-Checking.html">manual</a>) provides corrupted-list/unlink/double-free/overflow protections to the glibc heap memory manager (first introduced in glibc 2.3.4). This stops the ability to perform arbitrary code execution via heap memory overflows that try to corrupt the control structures of the malloc heap memory areas. This protection has evolved over time, adding more and more protections as additional <a class="http" href="http://www.phrack.com/issues.html?issue=66&id=10#article">corner-cases were researched</a>. As it currently stands, glibc 2.10 and later appears to successfully resist even these hard-to-hit conditions. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-glibc-security.py">test-glibc-security.py</a> for regression tests. <h3 id="Pointer_Obfuscation">Pointer Obfuscation</h3> Some <a class="https" href="https://udrepper.livejournal.com/13393.html">pointers stored in glibc are obfuscated</a> via PTR_MANGLE/PTR_UNMANGLE macros internally in glibc, preventing libc function pointers from being overwritten during runtime. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-glibc-security.py">test-glibc-security.py</a> for regression tests. <h3 id="Address_Space_Layout_Randomisation_.28ASLR.29">Address Space Layout Randomisation (ASLR)</h3> ASLR is implemented by the kernel and the ELF loader by randomising the location of memory allocations (stack, heap, shared libraries, etc). This makes memory addresses harder to predict when an attacker is attempting a memory-corruption exploit. ASLR is controlled system-wide by the value of <tt>/proc/sys/kernel/randomize_va_space</tt>. Prior to Ubuntu 8.10, this defaulted to "1" (on). In later releases that included brk ASLR, it defaults to "2" (on, with brk ASLR). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests for all the different types of ASLR. <h4 id="Stack_ASLR">Stack ASLR</h4> Each execution of a program results in a different stack memory space layout. This makes it harder to locate in memory where to attack or deliver an executable attack payload. This was available in the mainline kernel since 2.6.15 (Ubuntu 6.06). <h4 id="Libs.2Fmmap_ASLR">Libs/mmap ASLR</h4> Each execution of a program results in a different mmap memory space layout (which causes the dynamically loaded libraries to get loaded into different locations each time). This makes it harder to locate in memory where to jump to for "return to libc" to similar attacks. This was available in the mainline kernel since 2.6.15 (Ubuntu 6.06). <h4 id="Exec_ASLR">Exec ASLR</h4> Each execution of a program that has been built with "-fPIE -pie" will get loaded into a different memory location. This makes it harder to locate in memory where to attack or jump to when performing memory-corruption-based attacks. This was available in the mainline kernel since 2.6.25 (and was backported to Ubuntu 8.04 LTS). <h4 id="brk_ASLR">brk ASLR</h4> Similar to exec ASLR, brk ASLR adjusts the memory locations relative between the exec memory area and the brk memory area (for small mallocs). The randomization of brk offset from exec memory was added in 2.6.26 (Ubuntu 8.10), though some of the effects of brk ASLR can be seen for PIE programs in Ubuntu 8.04 LTS since exec was ASLR, and brk is allocated immediately after the exec region (so it was technically randomized, but not randomized with respect to the text region until 8.10). <h4 id="VDSO_ASLR">VDSO ASLR</h4> Each execution of a program results in a random vdso location. While this has existed in the mainline kernel since 2.6.18 (x86, PPC) and 2.6.22 (x86_64), it hadn't been enabled in Ubuntu 6.10 due to COMPAT_VDSO being enabled, which was removed in Ubuntu 8.04 LTS. This protects against jump-into-syscall attacks. Only x86 (maybe ppc?) is supported by glibc 2.6. glibc 2.7 (Ubuntu 8.04 LTS) supports x86_64 ASLR vdso. People needing ancient pre-libc6 static high vdso mappings can use "vdso=2" on the kernel boot command line to gain COMPAT_VDSO again. <ul><li><a class="https" href="https://lwn.net/Articles/184734/">https://lwn.net/Articles/184734/</a> </li><li><a class="https" href="https://articles.manugarg.com/systemcallinlinux2_6.html">https://articles.manugarg.com/systemcallinlinux2_6.html</a> </li></ul> <h3 id="Built_as_PIE">Built as PIE</h3> All programs built as Position Independent Executables (PIE) with "-fPIE -pie" can take advantage of the exec ASLR. This protects against "return-to-text" and generally frustrates memory corruption attacks. This requires centralized changes to the compiler options when building the entire archive. PIE has a large (5-10%) performance penalty on architectures with small numbers of general registers (e.g. x86), so it initially was only used for a <a href="/SecurityTeam/KnowledgeBase/BuiltPIE">select number of security-critical packages</a> (some upstreams natively support building with PIE, other require the use of "hardening-wrapper" to force on the correct compiler and linker flags). PIE on 64-bit architectures do not have the same penalties, and it was made the default (as of 16.10, it is the default on amd64, ppc64el and s390x). As of 17.10, it was decided that the security benefits are significant enough that PIE is now enabled across all architectures in the Ubuntu archive by default. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-built-binaries.py">test-built-binaries.py</a> for regression tests. <h3 id="Built_with_Fortify_Source">Built with Fortify Source</h3> Programs built with "-D_FORTIFY_SOURCE=2" (and -O1 or higher), enable several compile-time and run-time protections in glibc: <ul><li>expand unbounded calls to "sprintf", "strcpy" into their "n" length-limited cousins when the size of a destination buffer is known (protects against memory overflows). </li><li>stop format string "%n" attacks when the format string is in a writable memory segment. </li><li>require checking various important function return codes and arguments (e.g. system, write, open). </li><li>require explicit file mask when creating new files. </li></ul>See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-gcc-security.py">test-gcc-security.py</a> for regression tests. <h3 id="Built_with_RELRO">Built with RELRO</h3> Hardens ELF programs against loader memory area overwrites by having the loader mark any areas of the relocation table as read-only for any symbols resolved at load-time ("read-only relocations"). This reduces the area of possible GOT-overwrite-style memory corruption attacks. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-gcc-security.py">test-gcc-security.py</a> for regression tests. <h3 id="Built_with_BIND_NOW">Built with BIND_NOW</h3> Marks ELF programs to resolve all dynamic symbols at start-up (instead of on-demand, also known as "immediate binding") so that the GOT can be made entirely read-only (when combined with RELRO above). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-built-binaries.py">test-built-binaries.py</a> for regression tests. <h3 id="Built_with_-fstack-clash-protection">Built with -fstack-clash-protection</h3> Adds extra instructions around variable length stack memory allocations (via alloca() or gcc variable length arrays etc) to probe each page of memory at allocation time. This mitigates stack-clash attacks by ensuring all stack memory allocations are valid (or by raising a segmentation fault if they are not, and turning a possible code-execution attack into a denial of service). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-built-binaries.py">test-built-binaries.py</a> for regression tests. <h3 id="Built_with_-fcf-protection">Built with -fcf-protection</h3> Instructs the compiler to generate instructions to support Intel's Control-flow Enforcement Technology (CET). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-built-binaries.py">test-built-binaries.py</a> for regression tests. <h3 id="Non-Executable_Memory">Non-Executable Memory</h3> Most modern CPUs protect against executing non-executable memory regions (heap, stack, etc). This is known either as Non-eXecute (NX) or eXecute-Disable (XD), and some BIOS manufacturers needlessly disable it by default, so check your <a href="/Security/CPUFeatures">BIOS Settings</a>. This protection reduces the areas an attacker can use to perform arbitrary code execution. It requires that the kernel use "PAE" addressing (which also allows addressing of physical addresses above 3GB). The 64bit and 32bit <tt>-server</tt> and <tt>-generic-pae</tt> kernels are compiled with PAE addressing. Starting in Ubuntu 9.10, this protection is partially emulated for processors lacking NX when running on a 32bit kernel (built with or without PAE). After booting, you can see what NX protection is in effect: <ul><li>Hardware-based (via PAE mode): <pre>[ 0.000000] NX (Execute Disable) protection: active</pre></li><li>Partial Emulation (via segment limits): <pre>[ 0.000000] Using x86 segment limits to approximate NX protection</pre></li></ul>If neither are seen, you do not have any NX protections enabled. Check your BIOS settings and CPU capabilities. If "nx" shows up in each of the "flags" lines in <tt>/proc/cpuinfo</tt>, it is enabled/supported by your hardware (and a PAE kernel is needed to actually use it). Starting in Ubuntu 11.04, BIOS NX settings are <a class="https" href="https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ae84739c27b6b3725993202fe02ff35ab86468e1">ignored by the kernel</a>. <div><table><tbody><tr> <td colspan="5" style="text-align: center"> Ubuntu 9.04 and earlier </td> </tr> <tr> <td colspan="2" rowspan="2" style="text-align: center"> </td> <td colspan="2" style="text-align: center"> CPU supports NX </td> <td> CPU lacks NX </td> </tr> <tr> <td> BIOS enables NX </td> <td> BIOS disables NX </td> <td> </td> </tr> <tr> <td rowspan="2"> i386 </td> <td> <tt>-386</tt>, <tt>-generic</tt> kernel (non-PAE) </td> <td style="background-color: #dd0000"> nx unsupported </td> <td style="background-color: #dd0000"> nx unsupported </td> <td style="background-color: #dd0000"> nx unsupported </td> </tr> <tr> <td> <tt>-server</tt> kernel (PAE) </td> <td style="background-color: #00dd00"> real nx </td> <td style="background-color: #dd0000"> nx unsupported </td> <td style="background-color: #dd0000"> nx unsupported </td> </tr> <tr> <td> amd64 </td> <td> any kernel (PAE) </td> <td style="background-color: #00dd00"> real nx </td> <td style="background-color: #dd0000"> nx unsupported </td> <td> N/A </td> </tr> </tbody></table></div><div><table><tbody><tr> <td colspan="5" style="text-align: center"> Ubuntu 9.10 through 10.10 </td> </tr> <tr> <td colspan="2" rowspan="2" style="text-align: center"> </td> <td colspan="2" style="text-align: center"> CPU supports NX </td> <td> CPU lacks NX </td> </tr> <tr> <td> BIOS enables NX </td> <td> BIOS disables NX </td> <td> </td> </tr> <tr> <td rowspan="2"> i386 </td> <td> <tt>-386</tt>, <tt>-generic</tt> kernel (non-PAE) </td> <td style="background-color: #dddd00"> nx-emulation </td> <td style="background-color: #dddd00"> nx-emulation </td> <td style="background-color: #dddd00"> nx-emulation </td> </tr> <tr> <td> <tt>-server</tt>, <tt>-generic-pae</tt> kernel (PAE) </td> <td style="background-color: #00dd00"> real nx </td> <td style="background-color: #dddd00"> nx-emulation </td> <td style="background-color: #dddd00"> nx-emulation </td> </tr> <tr> <td> amd64 </td> <td> any kernel (PAE) </td> <td style="background-color: #00dd00"> real nx </td> <td style="background-color: #dd0000"> nx unsupported </td> <td> N/A </td> </tr> </tbody></table></div><div><table><tbody><tr> <td colspan="5" style="text-align: center"> Ubuntu 11.04 and later </td> </tr> <tr> <td colspan="2" style="text-align: center"> </td> <td> CPU supports NX </td> <td> CPU lacks NX </td> </tr> <tr> <td rowspan="2"> i386 </td> <td> <tt>-386</tt>, <tt>-generic</tt> kernel (non-PAE) </td> <td style="background-color: #dddd00"> nx-emulation </td> <td style="background-color: #dddd00"> nx-emulation </td> </tr> <tr> <td> <tt>-server</tt>, <tt>-generic-pae</tt> kernel (PAE) </td> <td style="background-color: #00dd00"> real nx </td> <td style="background-color: #dddd00"> nx-emulation </td> </tr> <tr> <td> amd64 </td> <td> any kernel (PAE) </td> <td style="background-color: #00dd00"> real nx </td> <td> N/A </td> </tr> </tbody></table></div>See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="A.2Fproc.2F.24pid.2Fmaps_protection">/proc/$pid/maps protection</h3> With ASLR, a process's memory space layout suddenly becomes valuable to attackers. The "maps" file is <a class="https" href="https://lkml.org/lkml/2007/3/10/250">made read-only</a> except to the process itself or the owner of the process. Went into mainline kernel with sysctl toggle in 2.6.22. The toggle was made non-optional in 2.6.27, forcing the privacy to be enabled regardless of sysctl settings (this is a good thing). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="Symlink_restrictions">Symlink restrictions</h3> A long-standing class of security issues is the symlink-based <a class="https" href="https://en.wikipedia.org/wiki/Time-of-check-to-time-of-use">ToCToU</a> race, most commonly seen in world-writable directories like <tt class="backtick">/tmp/</tt>. The common method of exploitation of <a class="https" href="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=tmp+symlink">this flaw</a> is crossing privilege boundaries when following a given symlink (i.e. a <tt class="backtick">root</tt> user follows a symlink belonging to another user). In Ubuntu 10.10 and later, symlinks in world-writable sticky directories (e.g. <tt class="backtick">/tmp</tt>) cannot be followed if the follower and directory owner do not match the symlink owner. The behavior is controllable through the <tt class="backtick">/proc/sys/kernel/yama/protected_sticky_symlinks</tt> sysctl, available via <a class="https" href="https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html">Yama</a>. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="Hardlink_restrictions">Hardlink restrictions</h3> Hardlinks can be abused in a <a class="https" href="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=hardlink">similar fashion</a> to symlinks above, but they are not limited to world-writable directories. If <tt class="backtick">/etc/</tt> and <tt class="backtick">/home/</tt> are on the same partition, a regular user can create a hardlink to <tt class="backtick">/etc/shadow</tt> in their home directory. While it retains the original owner and permissions, it is possible for privileged programs that are otherwise symlink-safe to mistakenly access the file through its hardlink. Additionally, a very minor untraceable quota-bypassing local denial of service is possible by an attacker exhausting disk space by filling a world-writable directory with hardlinks. In Ubuntu 10.10 and later, hardlinks cannot be created to files that the user would be unable to read and write originally, or are otherwise sensitive. The behavior is controllable through the <tt class="backtick">/proc/sys/kernel/yama/protected_nonaccess_hardlinks</tt> sysctl, available via <a class="https" href="https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html">Yama</a>. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="FIFO_restrictions">FIFO restrictions</h3> Processes may not check that the files being created are actually created as the desired type. This global control forbids some potentially unsafe configurations from working. See the <a class="https" href="https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html#protected-fifos">kernel admin-guide</a> for documentation. <h3 id="Regular_file_restrictions">Regular file restrictions</h3> Processes may not check that the files being created are actually created as desired. This global control forbids some potentially unsafe configurations from working. See the <a class="https" href="https://www.kernel.org/doc/html/latest/admin-guide/sysctl/fs.html#protected-regular">kernel admin-guide</a> for documentation. <h3 id="ptrace_scope">ptrace scope</h3> A troubling weakness of the Linux process interfaces is that a single user is able to examine the memory and running state of any of their processes. For example, if one application was compromised, it would be possible for an attacker to attach to other running processes (e.g. SSH sessions, GPG agent, etc) to extract additional credentials and continue to immediately expand the scope of their attack without resorting to user-assisted phishing or trojans. In Ubuntu 10.10 and later, users cannot ptrace processes that are not a descendant of the debugger. The behavior is controllable through the <tt class="backtick">/proc/sys/kernel/yama/ptrace_scope</tt> sysctl, available via <a class="https" href="https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html">Yama</a>. In the case of automatic crash handlers, a crashing process can specficially allow an existing crash handler process to attach on a process-by-process basis using <tt class="backtick">prctl(PR_SET_PTRACER, debugger_pid, 0, 0, 0)</tt>. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h2 id="Kernel_Hardening">Kernel Hardening</h2> The kernel itself has protections enabled to make it more difficult to become compromised. <h3 id="A0-address_protection">0-address protection</h3> Since the kernel and userspace share virtual memory addresses, the "NULL" memory space needs to be protected so that userspace mmap'd memory cannot start at address 0, stopping "NULL dereference" kernel attacks. This is possible with 2.6.22 kernels, and was implemented with the "mmap_min_addr" sysctl setting. Since Ubuntu 9.04, the mmap_min_addr setting is built into the kernel. (64k for x86, 32k for ARM.) See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="A.2Fdev.2Fmem_protection">/dev/mem protection</h3> Some applications (Xorg) need direct access to the physical memory from user-space. The special file <tt class="backtick">/dev/mem</tt> exists to provide this access. In the past, it was possible to view and change kernel memory from this file if an attacker had root access. The <a class="https" href="https://lwn.net/Articles/267427/">CONFIG_STRICT_DEVMEM kernel option</a> was introduced to block non-device memory access (originally named CONFIG_NONPROMISC_DEVMEM). See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="A.2Fdev.2Fkmem_disabled">/dev/kmem disabled</h3> There is no modern user of <tt class="backtick">/dev/kmem</tt> any more beyond attackers using it to load kernel rootkits. <a class="https" href="https://lkml.org/lkml/2008/2/10/328">CONFIG_DEVKMEM</a> is set to "n". While the <tt class="backtick">/dev/kmem</tt> device node still exists in Ubuntu 8.04 LTS through Ubuntu 9.04, it is not actually attached to anything in the kernel. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="Block_module_loading">Block module loading</h3> In Ubuntu 8.04 LTS and earlier, it was possible to <a class="https" href="https://www.debian.org/doc/manuals/securing-debian-howto/ch10.en.html#s-proactive">remove CAP_SYS_MODULES from the system-wide capability bounding set</a>, which would stop any new kernel modules from being loaded. This was another layer of protection to stop kernel rootkits from being installed. The 2.6.25 Linux kernel (Ubuntu 8.10) changed how bounding sets worked, and this functionality disappeared. Starting with Ubuntu 9.10, it is now <a class="https" href="https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=3d43321b7015387cfebbe26436d0e9d299162ea1">possible to block module loading</a> again by setting "1" in <tt>/proc/sys/kernel/modules_disabled</tt>. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="Read-only_data_sections">Read-only data sections</h3> This makes sure that certain kernel data sections are marked to block modification. This helps protect against some classes of kernel rootkits. Enabled via the CONFIG_DEBUG_RODATA option. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h3 id="Stack_protector">Stack protector</h3> Similar to the stack protector used for ELF programs in userspace, the kernel can protect its internal stacks as well. Enabled via the CONFIG_CC_STACKPROTECTOR option. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h3 id="Module_RO.2FNX">Module RO/NX</h3> This feature extends CONFIG_DEBUG_RODATA to include similar restrictions for loaded modules in the kernel. This can help resist future kernel exploits that depend on various memory regions in loaded modules. Enabled via the CONFIG_DEBUG_MODULE_RONX option. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for configuration regression tests. <h3 id="Kernel_Address_Display_Restriction">Kernel Address Display Restriction</h3> When attackers try to develop "run anywhere" exploits for kernel vulnerabilities, they frequently need to know the location of internal kernel structures. By treating kernel addresses as sensitive information, those locations are not visible to regular local users. Starting with Ubuntu 11.04, <tt>/proc/sys/kernel/kptr_restrict</tt> is set to "1" to block the reporting of known kernel address leaks. Additionally, various files and directories were made readable only by the root user: <tt class="backtick">/boot/vmlinuz*</tt>, <tt class="backtick">/boot/System.map*</tt>, <tt class="backtick">/sys/kernel/debug/</tt>, <tt class="backtick">/proc/slabinfo</tt> See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="Kernel_Address_Space_Layout_Randomisation">Kernel Address Space Layout Randomisation</h3> Kernel Address Space Layout Randomisation (kASLR) aims to make some kernel exploits more difficult to implement by randomizing the base address value of the kernel. Exploits that rely on the locations of internal kernel symbols must discover the randomized base address. kASLR is available starting with Ubuntu 14.10 and is enabled by default in 16.10 and later. Before 16.10, you can specify the "kaslr" option on the kernel command line to use kASLR. Note: Before 16.10, enabling kASLR will disable the ability to enter hibernation mode. <h3 id="Denylist_Rare_Protocols">Denylist Rare Protocols</h3> Normally the kernel allows all network protocols to be autoloaded on demand via the <tt>MODULE_ALIAS_NETPROTO(PF_...)</tt> macros. Since many of these protocols are old, rare, or generally of little use to the average Ubuntu user and may contain undiscovered exploitable vulnerabilities, they have been denylisted since Ubuntu 11.04. These include: ax25, netrom, x25, rose, decnet, econet, rds, and af_802154. If any of the protocols are needed, they can speficially loaded via modprobe, or the <tt>/etc/modprobe.d/blacklist-rare-network.conf</tt> file can be updated to remove the denylist entry. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="Syscall_Filtering">Syscall Filtering</h3> Programs can filter out the availability of kernel syscalls by using the <a class="https" href="https://lkml.org/lkml/2011/6/23/784">seccomp_filter interface</a>. This is done in containers or sandboxes that want to further limit the exposure to kernel interfaces when potentially running untrusted software. See <a class="https" href="https://git.launchpad.net/qa-regression-testing/tree/scripts/test-kernel-security.py">test-kernel-security.py</a> for regression tests. <h3 id="dmesg_restrictions">dmesg restrictions</h3> When attackers try to develop "run anywhere" exploits for vulnerabilties, they frequently will use dmesg output. By treating dmesg output as sensitive information, this output is not available to the attacker. Starting with Ubuntu 12.04 LTS, <tt>/proc/sys/kernel/dmesg_restrict</tt> can be set to "1" to treat dmesg output as sensitive. Starting with 20.10, this is enabled by default. <h3 id="Block_kexec">Block kexec</h3> Starting with Ubuntu 14.04 LTS, it is now <a class="https" href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7984754b99b6c89054edc405e9d9d35810a91d36">possible to disable kexec</a> via sysctl. CONFIG_KEXEC is enabled in Ubuntu so end users are able to use kexec as desired and the new sysctl allows administrators to disable kexec_load. This is desired in environments where CONFIG_STRICT_DEVMEM and modules_disabled are set, for example. When Secure Boot is in use, kexec is restricted by default to only load appropriately signed and trusted kernels. <h3 id="UEFI_Secure_Boot_.28amd64.29">UEFI Secure Boot (amd64)</h3> Starting with Ubuntu 12.04 LTS, UEFI Secure Boot was implemented in enforcing mode for the bootloader and non-enforcing mode for the kernel. With this configuration, a kernel that fails to verify will boot without UEFI quirks enabled. The Ubuntu 18.04.2 release of Ubuntu 18.04 LTS enabled enforcing mode for the bootloader and the kernel, so that kernels which fail to verify will not be booted, and kernel modules which fail to verify will not be loaded. This is planned to be backported for Ubuntu 16.04 LTS and Ubuntu 14.04 LTS (however only with kernel signature enforcement for Ubuntu 14.04 LTS, not kernel module signature enforcement). <h3 id="usbguard-1">usbguard</h3> Starting with Ubuntu 16.10, the usbguard package has been available in universe to provide a tool for using the Linux kernel's USB authorization support, to control device IDs and device classes that will be recognized. <h3 id="usbauth-1">usbauth</h3> Starting with Ubuntu 18.04, the usbauth package has been available in universe to provide a tool for using the Linux kernel's USB authorization support, to control device IDs and device classes that will be recognized. <h3 id="bolt-1">bolt</h3> Starting with Ubuntu 18.04, the bolt package has been available in main to provide a desktop-oriented tool for using the Linux kernel's Thunderbolt authorization support. <h3 id="thunderbolt-tools-1">thunderbolt-tools</h3> Starting with Ubuntu 18.04, the thunderbolt-tools package has been available in universe to provide a server-oriented tool for using the Linux kernel's Thunderbolt authorization support. <h3 id="Kernel_Lockdown">Kernel Lockdown</h3> Starting with Ubuntu 20.04, the Linux kernel's lockdown mode is enabled in integrity mode. This prevents the root account from loading arbitrary modules or BPF programs that can manipulate kernel datastructures. Lockdown enforcement is tied to UEFI secure boot. <h1 id="Additional_Documentation">Additional Documentation</h1> <ul><li>Coordination with Debian: <a class="https" href="https://wiki.debian.org/Hardening">https://wiki.debian.org/Hardening</a> </li><li>Gentoo's Hardening project: <a class="https" href="https://www.gentoo.org/proj/en/hardened/hardened-toolchain.xml">https://www.gentoo.org/proj/en/hardened/hardened-toolchain.xml</a> </li><li><a href="/Security/Features/Historical">Ubuntu Security Features for all releases</a> </li></ul>If you have questions or comments on these features, please <a href="/SecurityTeam/FAQ#Contact">contact the security team</a>. <hr /> <a class="nonexistent" href="/CategorySecurityTeam">CategorySecurityTeam</a> </div>  <div id="pagebottom"></div> </div> <div class="entry-utility"> Security/Features (last edited 2025-02-13 19:10:18 by <a class="interwiki" href="https://launchpad.net/~seth-arnold" title="seth-arnold @ 2001:67c:1562:8007::aac:4047[2001:67c:1562:8007::aac:4047]">seth-arnold</a>) </div> </div> </div> </div> <div class="clearBoth"></div> </div> </div> <div id="footer"> <div id="siteinfo"> The material on this wiki is available under a free license, see <a href="https://help.ubuntu.com/community/License">Copyright / License</a> for details. </div> </div> <script> (function(i,s,o,g,r,a,m){ i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-1018242-7', 'auto'); ga('send', 'pageview'); </script></body> </html>