mediumsystemverified ✓

Remove unused dependencies and kernels after APT updates

apt-remove-unused-dependencies · UBUNTU ≥ 22 · 1 impl

Description

The APT unattended-upgrades configuration must remove unused dependencies and unused kernel packages after updated versions are installed, so superseded software components do not remain on the system.

Rationale

Leaving superseded or unused software installed after an update expands the attack surface: old libraries and kernels can carry known vulnerabilities that remain exploitable even though the running version is patched. Removing them keeps the installed set minimal and current.

Check → Remediate

Checkcommand

conf=/etc/apt/apt.conf.d/50unattended-upgrades
grep -Eq '^[[:space:]]*Unattended-Upgrade::Remove-Unused-Dependencies[[:space:]]+"true"' "$conf" 2>/dev/null || exit 1
grep -Eq '^[[:space:]]*Unattended-Upgrade::Remove-Unused-Kernel-Packages[[:space:]]+"true"' "$conf" 2>/dev/null || exit 1
exit 0

expected_exit:: 0

Remediatemanual

note:: In /etc/apt/apt.conf.d/50unattended-upgrades set (uncommented): Unattended-Upgrade::Remove-Unused-Dependencies "true"; and Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

Framework references

STIG

V-270773 / UBTU-24-700320V-260477 / UBTU-22-214015

NIST 800-53

SI-2CM-6

Live verification

ubuntu22:checkubuntu24:check

#apt#unattended-upgrades#patching#stig