Handbook sections▾
Foundations
Understanding the threats to a Linux hostWhy we hardenThe defense principles behind every ruleEffective configuration: the truth no file holdsThe standards Pavois maps toSOCLE control ID modelEvidence & exportsHow the A-E grade is computedWhat a PASS proves: the qualified verdictTrust model for the evidence bundleIs SOCLE just your own norm? (governance & the circularity question)What Pavois covers, and what it doesn'tDomains
Hardening SSHHardening PAMMandatory Access Control (SELinux / AppArmor)Hardening the host firewallHardening sudoFile Permissions & OwnershipMount & filesystem hardeningHardening kernel modulesHardening the kernel & network with sysctlAudit logging with auditdHardening logging with journald and rsyslogHardening systemd servicesPackage hygieneHardening the bootloader (GRUB)Synchronizing timeLogin banners and MOTDControlling cron and at accessHardening the GNOME desktop (dconf)Tooling
Undo a hardening run: restore pointsOperating Pavois: privileges, air-gap, timing, exceptionsRun Pavois in CI (GitHub Actions)Feature status: delivered, partial, roadmapGovernance: licence, versioning, provenance, securityFeature status: delivered, partial, roadmap
Last reviewed
An honest map of every Pavois claim against what ships today, what is partial, and what is on the roadmap. No claim without a status.
A reference has to be honest about its own edges. This page maps each capability to one of three states: delivered (works today), partial (works but incomplete), roadmap (announced, not yet shipped).
Engine and verdict
| Capability | Status | Notes |
|---|---|---|
Effective-config audit (sshd -T, sysctl, systemctl, auditctl) |
delivered | the core read; the resolved view, not a lone config file |
| One control, N standards (CIS / ANSSI BP-028 / NIST / PCI-DSS / STIG) | delivered | a single check carries every applicable mapping |
| A to E grade with critical-failure caps | delivered | formula published, frozen by a test |
| Qualified verdict (evidence type + reboot-survivability) | delivered | per-fiche "a pass proves" matrix |
| Grade cap on runtime-only passes (runtime-qualified) | delivered | a clean A needs proven persistence |
Reboot-proof verification (harden apply --reboot --scan) |
delivered | re-scan after a real reboot |
Harden and exports
| Capability | Status | Notes |
|---|---|---|
| Harden as code (native Chef plan, opt-in per rule, dry-run) | delivered | no blind shell script |
Rollback a hardening run (harden rollback) |
delivered | restores files/packages/services from a pre-apply restore point; 96% of controls, gaps named (rollback) |
| Exports SARIF / JUnit / JSON / CSV / HTML | delivered | see Evidence & exports |
CI gate (--fail-under, exit codes) |
delivered | see Run Pavois in CI |
| Behavioral verify (attempt the forbidden action) | delivered | pavois verify |
| OSCAL catalog + per-OS profiles | delivered | see Downloads |
| Before/after campaign report (transition matrix) | delivered | pavois diff --html |
| Evidence bundle (manifest + checksums, sign-ready) | delivered | pavois bundle |
| Posture by remediation class + remediable grade | delivered | see Scoring |
| Executive summary in the HTML report | delivered | top gaps + posture, client-side |
| Reboot-proof artifact (boot_id before/after) | delivered | harden apply --reboot |
| OSCAL assessment-results (a scan as OSCAL) | roadmap | the standard ships; a scan-as-OSCAL package does not yet |
Distribution and coverage
| Capability | Status | Notes |
|---|---|---|
Build from source (mise + go build) |
delivered | see Get started |
Environment check (pavois doctor) |
delivered | verifies CINC engine, sudo, SSH, OS, rule corpus |
| Signed release binary and .deb/.rpm | delivered | GitHub releases: static binaries (linux/darwin, amd64/arm64), packages, checksums, CycloneDX SBOM, SLSA provenance and a Cosign signature |
| Container image | roadmap | no image is published yet |
| Firewall ruleset audit (nft / ufw / firewalld zones) | partial | presence and default-deny only |
| Logging: remote forwarding, integrity | partial | basic journald only |
| MAC policy audit (custom SELinux / AppArmor, AVC, unconfined) | partial | enforcing-status only |
The coverage detail, with control counts per domain, is on What Pavois covers.
Where status is tracked
This table is the source of truth for capability status; the underlying work is tracked in the repository's GitHub issues and CHANGELOG, and shipped versions appear in GitHub Releases. The page carries a dateModified so you can see when it was last reviewed.
FAQ
Where does the signed release binary come from? The GitHub releases of the repository. Every asset carries a SHA-256 in checksums.txt, a SLSA build provenance and a keyless Cosign signature, all three checkable without any access to the repository.
Is OSCAL support complete? The OSCAL catalog and per-OS profiles are delivered and downloadable; only the per-scan assessment-results package is roadmap.
Why mark things partial instead of hiding them? A reference earns trust by naming its own edges. partial and roadmap are stated so a green grade is never mistaken for total coverage.
Key takeaways
- Every headline claim here is delivered; the remaining gaps are a container image and depth on a few domains.
partialandroadmapare named on purpose: a reference earns trust by marking its own edges.