Essential Eight on Linux, Part 7 of 8: User Application Hardening on Ubuntu 26.04 LTS Source
Markdown source
1---2title: "Essential Eight on Linux, Part 7 of 8: User Application Hardening on Ubuntu 26.04 LTS"3date: "2026-05-04"4published: true5tags: ["essential-eight", "asd", "ism", "ubuntu", "linux", "firefox", "apparmor", "browser-isolation", "security"]6author: "Gavin Jackson"7excerpt: "Part 7 of an 8-part series on implementing the Essential Eight on Ubuntu 26.04 LTS, covering browser and user application hardening with Firefox policies, snap confinement, AppArmor, and isolation controls."8---910# Essential Eight on Linux, Part 7 of 8: User Application Hardening on Ubuntu 26.04 LTS1112Of all the Essential Eight mitigations, this one is probably the most naturally adaptable to Linux.1314The reason is simple: the underlying security idea is not Windows-specific at all. Harden the software users attack with first. That is just as relevant on Ubuntu 26.04 LTS as anywhere else.1516Browsers, PDF readers, email clients, collaboration tools, and document handlers are all part of the frontline.1718## What ASD is trying to achieve1920The Essential Eight user application hardening mitigation is about reducing unnecessary functionality in common user-facing software so attackers have fewer ways to execute code, pivot, or deliver payloads.2122On Linux, that mostly becomes:2324- browser hardening25- document viewer hardening26- script and plugin reduction27- stronger defaults for content handling28- isolation for risky applications2930## Ubuntu 26.04 LTS reference implementation3132### Resolute Raccoon highlights3334Ubuntu 26.04 LTS is actually a nice step forward for this mitigation:3536- GNOME 50 on Wayland reduces some legacy X11 desktop attack patterns, especially around global input and screen access37- application permission prompting is improved, with early integration into the **Security Center**3839None of that replaces hardening policy, but it gives you a cleaner base desktop than Ubuntu 24.04 LTS did.4041### 1. Start with the browser4243Ubuntu 26.04 ships Firefox as a snap, which is already a helpful default because you get:4445- confinement46- central update channels47- a cleaner packaging model4849But that is only the start. For managed environments, use enterprise browser policies to enforce settings such as:5051- extension allowlists52- password manager decisions53- telemetry or privacy settings consistent with policy54- download restrictions55- homepage and safe browsing controls5657For Chromium-based browsers on Linux, the same principle applies. The platform is not the hard bit. The discipline is.5859### How to implement enterprise browser policies on Ubuntu6061This is the part that often gets hand-waved away.6263On Linux, the practical pattern is usually:64651. define your browser standards in JSON662. deploy them with your configuration management tool673. verify enforcement on endpoints684. keep the package source for the browser under central control6970For **Firefox**, Mozilla supports cross-platform policy management through `policies.json`.7172On Linux, the usual system-wide location is:7374```text75/etc/firefox/policies/policies.json76```7778On Ubuntu, this path also works for the Firefox snap. Make the file root-owned and writable only by administrators; otherwise, you have a preference file rather than an enterprise control.7980A minimal example might look like this:8182```json83{84 "policies": {85 "DisableFirefoxStudies": true,86 "DisablePocket": true,87 "DisableTelemetry": true,88 "BlockAboutConfig": true,89 "ExtensionSettings": {90 "*": {91 "installation_mode": "blocked"92 },93 "uBlock0@raymondhill.net": {94 "installation_mode": "force_installed",95 "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"96 }97 }98 }99}100```101102That gives you a simple Linux-native way to:103104- block unapproved extensions105- force-install approved ones106- lock down settings standard users should not change107- push a consistent browser posture across an Ubuntu fleet108109For **Google Chrome on Linux**, Google documents two policy tiers:110111- **managed** policies that users cannot override112- **recommended** policies that set defaults users may change113114Typical paths are:115116```text117/etc/opt/chrome/policies/managed/118/etc/opt/chrome/policies/recommended/119```120121For Chromium-based builds managed through distro packaging, the equivalent path may instead be under:122123```text124/etc/chromium/policies/125```126127A simple managed policy file could look like:128129```json130{131 "BrowserSignin": 0,132 "PasswordManagerEnabled": false,133 "SafeBrowsingProtectionLevel": 2,134 "ExtensionInstallBlocklist": ["*"],135 "ExtensionInstallAllowlist": [136 "ddkjiahejlhfcafbddmgiahcphecmpfh"137 ],138 "ExtensionInstallForcelist": [139 "ddkjiahejlhfcafbddmgiahcphecmpfh;https://clients2.google.com/service/update2/crx"140 ]141}142```143144That example blocks user-installed extensions by default and force-installs **uBlock Origin Lite**, which is the Manifest V3-friendly version for Chrome. If your organisation uses Chrome Enterprise Core or a commercial secure web gateway, you may prefer to manage extension policy there instead of hard-coding extension IDs directly into local JSON.145146At fleet scale, I would not hand-place these files. I would push them with:147148- **Landscape** for script and package driven enforcement149- **Ansible**, **Puppet**, or **Salt** if that is already your Linux config baseline150- an immutable desktop image pipeline if the workstations are provisioned from a gold image151152To validate the result:153154- in Firefox, check `about:policies`155- in Chrome, check `chrome://policy`156157That verification step matters. A policy file that exists on disk but is ignored by the packaged browser is not a control.158159### 2. Remove dead features and dangerous defaults160161A lot of historical browser attack surface simply should not exist anymore:162163- Java browser plugins or Java Web Start/JNLP helpers unless explicitly required164- unmanaged external protocol handlers165- unmanaged extension sprawl166- automatic file handling for risky content167168On Ubuntu, this is partly a browser policy problem and partly a software standardisation problem. The practical control is to define what handlers, extensions, download behaviours, and helper applications are allowed, then test those settings through `about:policies` or `chrome://policy`.169170### 3. Treat ad, script, and active-content control as part of hardening171172The ASD guidance includes blocking web advertisements and unnecessary active content for good reason.173174For Ubuntu desktops, that can mean:175176- enterprise-managed content blocking in the browser177- DNS or secure web gateway filtering178- remote browser isolation for higher-risk use cases179180You do not have to make the desktop miserable. But you should absolutely reduce the number of hostile scripts users are expected to process by default.181182For many Ubuntu fleets, a sensible pattern is:183184- one approved ad or content-blocking extension, centrally installed185- browser-side pop-up and download restrictions186- DNS or SWG filtering for known malicious domains187- a separate isolated path for genuinely risky browsing instead of trying to make every endpoint absorb that risk188189### 4. Harden document and PDF handling190191Browsers are not the only target. PDF readers, office suites, and mail clients should also be part of the design.192193On Ubuntu:194195- prefer simple viewers over feature-heavy document tooling where possible196- keep document handlers patched197- confine risky apps with AppArmor198- open especially risky content in isolated sessions rather than directly on the endpoint199200### 5. Use isolation where hardening is not enough201202Some use cases simply carry more risk:203204- research on the open internet205- handling untrusted attachments206- accessing third-party portals207208That is where isolation tools are more honest than trying to harden a general-purpose desktop into something it is not. Browser isolation, remote workspace patterns, or disposable sessions can all help here.209210### Kasm as a commercial isolation pattern211212One product worth calling out explicitly here is **Kasm Workspaces**.213214Kasm is useful because it changes the location where the risky web code executes. Instead of the user's Ubuntu endpoint processing hostile websites directly, the browsing session runs in a **remote, containerised browser** and is streamed back to the user. The endpoint is interacting with the rendered session, not running the full browsing workload locally.215216That makes Kasm a very practical commercial answer when your security objective is not just "harden the browser a bit more" but "move high-risk web activity off the endpoint altogether."217218From an Essential Eight perspective, Kasm fits especially well as an uplift control for:219220- `ISM-1485` around reducing exposure to web advertisements and active content221- `ISM-1412` around restricting risky browser processing paths222- `ISM-1585` where browser security settings need to be enforced rather than left to users223224It is not a direct replacement for every Windows-specific Office or PDF hardening control, but it is a very practical way to move high-risk web activity out of the standard endpoint session.225226Kasm is especially compelling for Linux-heavy shops because it is not Windows-dependent and does not require you to pretend every risky workflow should be solved on the endpoint itself.227228### Good Kasm use cases on an Ubuntu fleet229230Here are a few situations where Kasm makes a lot of sense:231232- **Internet research from secure or sensitive environments**: analysts, engineers, or administrators can browse the open internet without giving the local workstation direct exposure to the full web threat surface.233- **Opening suspicious links from email or chat**: users can push high-risk links into an isolated browser instead of handling them in their standard desktop session.234- **Third-party or BYOD access**: contractors can use a browser-delivered isolated workspace without getting broad direct access from their local machine into your environment.235- **Cross-domain or regulated browsing**: teams working in government, defence, legal, or finance can enforce tighter clipboard, upload, download, and session controls around browser activity.236- **OSINT and investigative work**: Kasm is also useful when you want disposable browsing sessions, alternate egress points, and less attribution back to the analyst workstation.237238### A practical Kasm pattern239240The strongest pattern is usually not "everyone browses everything through Kasm all the time."241242It is more often:243244- standard browser hardening on all Ubuntu endpoints245- Kasm for high-risk browsing roles246- Kasm for suspicious links or unknown websites247- policy controls on uploads, downloads, clipboard, and printing in the isolated browser248- SSO and MFA in front of the Kasm environment249250That gives you a good balance between productivity and containment.251252> **Logs or it didn't happen**253>254> There does not appear to be an official Ubuntu 26.04 support listing for Elasticsearch yet, so I would not present it as a certified 26.04 reference build today. That said, Elastic remains one of the top-tier distributed logging and search options in the Linux ecosystem, and it is absolutely worth considering for centralising Ubuntu system and application logs.255>256> The classic Elastic Stack is made up of four main pieces: **Elasticsearch** for storage and search, **Logstash** for ingest and enrichment, **Kibana** for dashboards and investigation, and **Beats** such as Filebeat for shipping host and application logs.257>258> In an Essential Eight context, the important point is not "install Elastic and declare victory." It is having protected, searchable evidence that browser policy, AppArmor, audit, application, and endpoint events are being collected and reviewed. I will come back to this properly in a future deep-dive on Elasticsearch fundamentals.259260## ISM control mapping261262The October 2024 Essential Eight to ISM mapping is very Windows-heavy in this area, so the honest Linux answer is a mix of direct controls, compensating controls, and clearly documented non-applicability.263264| ISM control | E8 requirement in plain English | Ubuntu 26.04 implementation |265|-------------|----------------------------------|-----------------------------|266| `ISM-1654` | Internet Explorer 11 is disabled or removed. | Not applicable on Ubuntu by default. Document it as N/A and avoid reintroducing IE through Wine or remote application publishing unless it is isolated and explicitly approved. |267| `ISM-1486` | Web browsers do not process Java from the internet. | Do not install Java browser plugins or Java Web Start handlers. If Java is needed for internal tools, restrict it to approved internal origins and verify browser/helper handling. |268| `ISM-1485` | Web browsers do not process web advertisements from the internet. | Use an enterprise-managed content blocker, secure web gateway, DNS filtering, or remote browser isolation for higher-risk roles. |269| `ISM-1412` | Browsers are hardened using ASD and vendor guidance. | Enforce Firefox `policies.json` or Chrome managed policies, then verify with `about:policies` or `chrome://policy`. |270| `ISM-1585` | Browser security settings cannot be changed by users. | Store browser policy files as root-owned configuration deployed by Landscape, Ansible, Puppet, Salt, or a managed image pipeline. |271| `ISM-1667` | Microsoft Office is blocked from creating child processes. | No neat native equivalent exists for LibreOffice. Use AppArmor or isolated sessions for high-risk document handling, and use managed remote Windows Office if exact Microsoft Office control coverage is required. |272| `ISM-1668` | Microsoft Office is blocked from creating executable content. | Disable office macros unless required, avoid trusted write-execute locations, and treat document-created scripts or binaries as blocked content in endpoint monitoring. |273| `ISM-1669` | Microsoft Office is blocked from injecting code into other processes. | Mostly Windows-specific. For Linux office suites, reduce exposure with AppArmor confinement and isolation for untrusted documents. |274| `ISM-1542` | Microsoft Office is configured to prevent activation of OLE packages. | Mostly Windows-specific. Avoid Wine-based Office for standard users, disable external object activation where supported, and open untrusted documents in isolated sessions. |275| `ISM-1859` | Office productivity suites are hardened using ASD and vendor guidance. | Baseline LibreOffice, OnlyOffice, or browser-based office tooling through managed configuration, and record any settings that cannot be centrally locked. |276| `ISM-1823` | Office productivity suite security settings cannot be changed by users. | Use root-owned configuration, a managed desktop image, or isolation. If the chosen office suite cannot enforce a setting centrally, treat that as a control gap. |277| `ISM-1670` | PDF software is blocked from creating child processes. | Prefer simple PDF viewers, keep PDF handling patched, and use AppArmor or browser isolation for untrusted PDF workflows. |278| `ISM-1860` | PDF software is hardened using ASD and vendor guidance. | Disable PDF JavaScript or active features where the reader supports it, and avoid feature-heavy readers unless there is a business need. |279| `ISM-1824` | PDF software security settings cannot be changed by users. | Choose PDF tooling that can be centrally configured, or enforce the workflow through managed images and isolated sessions. |280| `ISM-1655` | .NET Framework 3.5 is disabled or removed. | Windows-specific. On Ubuntu, avoid unsupported legacy .NET or Wine runtime stacks unless they are isolated and business-owned. |281| `ISM-1621` | Windows PowerShell 2.0 is disabled or removed. | Not installed on Ubuntu by default. If PowerShell is installed, standardise on a supported PowerShell 7 package and remove legacy or unmanaged copies. |282| `ISM-1622` | PowerShell uses Constrained Language Mode. | There is no strong WDAC/AppLocker-backed Ubuntu equivalent. Avoid broad PowerShell use on desktops, or restrict it to controlled admin workstations and jump hosts. |283| `ISM-1623`, `ISM-1889` | PowerShell and command-line process creation events are centrally logged. | If PowerShell is present, forward its logs. For Linux command execution, use `auditd`, Sysmon for Linux, osquery, Wazuh, Elastic Agent, Microsoft Defender for Endpoint, or another EDR path. |284| `ISM-1815`, `ISM-1906`, `ISM-1907`, `ISM-0109`, `ISM-1228`, `ISM-0123`, `ISM-0140`, `ISM-1819` | Logs are protected, analysed, reported, and used in incident response. | Forward browser, application, audit, and EDR telemetry to a central platform with retention, access control, and tamper protection. |285286## Linux-friendly commercial additions287288If you need more than native browser policy and AppArmor can offer, the cleanest commercial additions are usually:289290- **Cloudflare Remote Browser Isolation**291- **Kasm Workspaces**292- **Menlo Security**293- **secure web gateways** that enforce content filtering and isolation policies294295These work well with Linux because the control is delivered through the browser or network path, not through a Windows-only endpoint dependency.296297## A practical Ubuntu hardening baseline298299For Ubuntu 26.04 desktops, I would start with:300301- one or two approved browsers only302- enterprise browser policies with controlled extensions303- no unmanaged extension installs304- controlled protocol handlers and automatic file handling305- ad and script reduction for high-risk groups306- AppArmor on user-facing apps307- patched PDF and document tooling308- Kasm for risky browsing, unknown links, or regulated web access roles309- isolated browsing for risky internet research roles310311That is a sensible baseline without becoming unmanageable.312313## The bottom line314315User application hardening is one of the more achievable Essential Eight mitigations on Ubuntu 26.04 LTS.316317The trick is not to overcomplicate it. Harden the browser with real managed policies, reduce active content, control extensions, keep document handlers patched, and use isolation for higher-risk workflows. Linux gives you enough native leverage here that the control can be both practical and strong, and products like Kasm give you a credible commercial step-up when endpoint hardening alone is not enough.318319## References320321- [ASD Essential Eight maturity model and ISM mapping (October 2024)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model-and-ism-mapping)322- [Canonical releases Ubuntu 26.04 LTS Resolute Raccoon](https://ubuntu.com/blog/canonical-releases-ubuntu-26-04-lts-resolute-raccoon)323- [Firefox enterprise policies](https://mozilla.github.io/policy-templates/)324- [Customize Firefox using policies.json](https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson)325- [Chrome Browser quick start for Linux](https://support.google.com/chrome/a/answer/9025903?hl=en)326- [Set Chrome policies](https://support.google.com/chrome/a/answer/9027408?hl=en)327- [uBlock Origin Lite - Chrome Web Store](https://chromewebstore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh)328- [AppArmor on Ubuntu](https://ubuntu.com/server/docs/how-to/security/apparmor/)329- [Kasm browser isolation docs](https://docs.kasm.com/docs/latest/guide/browser_isolation/index.html)330- [Kasm web isolation use cases](https://kasm.com/solutions/web-isolation)331- [Cloudflare Remote Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/)332- [Menlo Remote Browser Isolation](https://www.menlosecurity.com/product/remote-browser-isolation)333- [Elastic Support Matrix](https://www.elastic.co/support/matrix/)334