---
title: Disable Apport Service
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Disable Apport Service
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Disable Apport Service
 
## Description{% #description %}

The Apport modifies certain kernel configuration values at runtime which may decrease the overall security of the system and expose sensitive data. Disable Apport in `/etc/default/apport`:

```
enabled=0
```

Then stop and mask the `apport` service:

```
$ sudo systemctl stop apport.service
$ sudo systemctl mask apport.service
```

This rule checks that every `enabled` setting in `/etc/default/apport` is `0` and that `apport.service` is stopped.

## Rationale{% #rationale %}

The Apport service modifies the kernel `fs.suid_dumpable` configuration at runtime which prevents other hardening from being persistent. Disabling the service prevents this behavior. Apport also collects core dumps, stack traces, and log files, which can contain passwords and other private data.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}' 'apport' 2>/dev/null | grep -q '^installed$'; then

if LC_ALL=C grep -qiE '^[[:space:]]*enabled[[:space:]]*=' /etc/default/apport 2>/dev/null; then
    LC_ALL=C sed -i --follow-symlinks -E 's/^[[:space:]]*enabled[[:space:]]*=.*/enabled=0/I' /etc/default/apport
else
    if [[ -s "/etc/default/apport" ]] && [[ -n "$(tail -c 1 -- "/etc/default/apport" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/default/apport"
    fi
    printf '%s\n' 'enabled=0' >> /etc/default/apport
fi

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
    "$SYSTEMCTL_EXEC" stop 'apport.service'
fi
"$SYSTEMCTL_EXEC" disable 'apport.service'
"$SYSTEMCTL_EXEC" mask 'apport.service'
"$SYSTEMCTL_EXEC" reset-failed 'apport.service' || true

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```go
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_apport_disabled
  - unknown_severity

- name: Disable Apport Service - Set enabled=0 in /etc/default/apport
  ansible.builtin.lineinfile:
    path: /etc/default/apport
    regexp: (?i)^\s*enabled\s*=
    line: enabled=0
    create: true
    mode: '0644'
  when: '"apport" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_apport_disabled
  - unknown_severity

- name: Disable Apport Service - Set every enabled line of /etc/default/apport to
    0
  ansible.builtin.replace:
    path: /etc/default/apport
    regexp: (?i)^[ \t]*enabled[ \t]*=.*$
    replace: enabled=0
  when: '"apport" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_apport_disabled
  - unknown_severity

- name: Disable Apport Service - Collect systemd Services Present in the System
  ansible.builtin.service_facts: null
  check_mode: false
  when: '"apport" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_apport_disabled
  - unknown_severity

- name: Disable Apport Service - Stop and Mask apport.service
  ansible.builtin.systemd:
    name: apport.service
    state: stopped
    enabled: false
    masked: true
  when:
  - '"apport" in ansible_facts.packages'
  - '"apport.service" in ansible_facts.services'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_apport_disabled
  - unknown_severity
```