

<def-group>
  <definition class="compliance" id="sysctl_user_max_user_namespaces" version="3">
    <metadata>
        <title>Disable the use of user namespaces</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in system configuration and system runtime.</description>
    </metadata>
    <criteria operator="AND">
      <extend_definition comment="user.max_user_namespaces configuration setting check"
                         definition_ref="sysctl_user_max_user_namespaces_static"/>

      <extend_definition comment="user.max_user_namespaces runtime setting check"
                         definition_ref="sysctl_user_max_user_namespaces_runtime"/>
    </criteria>
  </definition>
</def-group>


<def-group>
  <definition class="compliance" id="sysctl_user_max_user_namespaces_runtime" version="3">
    <metadata>
        <title>Disable the use of user namespaces</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system runtime.</description>
    </metadata>
    <criteria operator="AND">
      <criterion comment="kernel runtime parameter user.max_user_namespaces set to 0"
                 test_ref="test_sysctl_user_max_user_namespaces_runtime"/>
    </criteria>
  </definition>

  <unix:sysctl_test id="test_sysctl_user_max_user_namespaces_runtime" version="1"
                    comment="kernel runtime parameter user.max_user_namespaces set to 0"
                    check="all" check_existence="all_exist" state_operator="OR">
    <unix:object object_ref="object_sysctl_user_max_user_namespaces_runtime"/>

    <unix:state state_ref="state_sysctl_user_max_user_namespaces_runtime"/>

  </unix:sysctl_test>

  <unix:sysctl_object id="object_sysctl_user_max_user_namespaces_runtime" version="1">
    <unix:name>user.max_user_namespaces</unix:name>
  </unix:sysctl_object>


  <unix:sysctl_state id="state_sysctl_user_max_user_namespaces_runtime" version="1">

    <unix:value datatype="int"
                operation="equals">0</unix:value>

  </unix:sysctl_state>

</def-group>



<def-group>
  <definition class="compliance" id="sysctl_user_max_user_namespaces_static" version="3">
    <metadata>
        <title>Disable the use of user namespaces</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>The kernel 'user.max_user_namespaces' parameter should be set to 0 in the system configuration.</description>
    </metadata>

    <criteria operator="OR">
      <!--  Processing differently files in /usr/lib/sysctl.d/ as they are managed by packages and
            won't be fixed by remediations, see sysctl.d(5) -->
      <criterion comment="kernel static parameter user.max_user_namespaces set to 0 in sysctl files not managed by packages"
                    test_ref="test_sysctl_user_max_user_namespaces_static_user" />
      <criteria operator="AND">
        <criterion comment="kernel static parameter user.max_user_namespaces missing in sysctl files not managed by packages"
                    test_ref="test_sysctl_user_max_user_namespaces_static_user_missing" />
        
          <criterion comment="kernel static parameter user.max_user_namespaces set to 0 in sysctl files managed by packages"
                    test_ref="test_sysctl_user_max_user_namespaces_static_pkg_correct" />
        
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_sysctl_user_max_user_namespaces_static_user_missing" version="1"
                              check="all" check_existence="none_exist"
                              comment="user.max_user_namespaces static configuration">
    <ind:object object_ref="object_static_user_sysctl_user_max_user_namespaces" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_test id="test_sysctl_user_max_user_namespaces_static_user" version="1"
                              check="all" check_existence="all_exist"
                              comment="user.max_user_namespaces static configuration" state_operator="OR">
    <ind:object object_ref="object_static_user_sysctl_user_max_user_namespaces"/>

    <ind:state state_ref="state_static_sysctld_sysctl_user_max_user_namespaces"/>

  </ind:textfilecontent54_test>

  
  <ind:textfilecontent54_test id="test_sysctl_user_max_user_namespaces_static_pkg_correct" version="2" check="all"
                          check_existence="all_exist"
                          comment="user.max_user_namespaces static configuration in /usr/lib/sysctl.d/*.conf"
                          state_operator="OR">
    <ind:object object_ref="object_static_usr_lib_sysctld_sysctl_user_max_user_namespaces"/>

    <ind:state state_ref="state_static_sysctld_sysctl_user_max_user_namespaces"/>

  </ind:textfilecontent54_test>
  

  <!-- Avoid directly referencing a possibly empty collection, one empty collection will cause the
       variable to have no value even when there are valid objects. -->
  <ind:textfilecontent54_object id="object_static_user_sysctl_user_max_user_namespaces" version="1">
    <set>
      <object_reference>object_static_etc_lib_sysctls_sysctl_user_max_user_namespaces</object_reference>
      <object_reference>object_static_run_usr_local_sysctls_sysctl_user_max_user_namespaces</object_reference>
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_etc_lib_sysctls_sysctl_user_max_user_namespaces" version="1">
    <set>
      <object_reference>object_static_etc_sysctls_sysctl_user_max_user_namespaces</object_reference>

    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_etc_sysctls_sysctl_user_max_user_namespaces" version="1">
    <set>
      <object_reference>object_static_sysctl_sysctl_user_max_user_namespaces</object_reference>
      <object_reference>object_static_etc_sysctld_sysctl_user_max_user_namespaces</object_reference>
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_run_usr_local_sysctls_sysctl_user_max_user_namespaces" version="1">
    <set>
      <object_reference>object_static_usr_local_lib_sysctld_sysctl_user_max_user_namespaces</object_reference>
      <object_reference>object_static_run_sysctld_sysctl_user_max_user_namespaces</object_reference>
    </set>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_object id="object_static_sysctl_sysctl_user_max_user_namespaces" version="1">

    <ind:filepath operation="pattern match">/etc(/ufw){0,1}/sysctl.conf$</ind:filepath>

    <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_etc_sysctld_sysctl_user_max_user_namespaces" version="1">
    <ind:path>/etc/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_run_sysctld_sysctl_user_max_user_namespaces" version="1">
    <ind:path>/run/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_usr_local_lib_sysctld_sysctl_user_max_user_namespaces" version="1">
    <ind:path>/usr/local/lib/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_static_usr_lib_sysctld_sysctl_user_max_user_namespaces" version="1">
    <ind:path>/usr/lib/sysctl.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*(.*\S)[\s]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>



  <ind:textfilecontent54_state id="state_static_sysctld_sysctl_user_max_user_namespaces" version="1">

    <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>

  </ind:textfilecontent54_state>


</def-group>