Configure kernel to zero out memory before allocation
Ensures the kernel booted with init_on_alloc=1, which zero-fills page and slab allocations so freshly allocated memory never carries stale data.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
With init_on_alloc=1, all page-allocator and slab-allocator memory is zeroed when allocated. This eliminates a whole class of "uninitialised heap memory" bugs where freshly allocated buffers expose leftover data from a previous owner, a common vector for information disclosure (leaking secrets, keys, or pointers that defeat ASLR) and for turning use-of-uninitialised-memory bugs into exploitable conditions.
What Pavois checks
Pavois reads /proc/cmdline, the line the running kernel booted with, and checks for init_on_alloc=1. This is more reliable than reading /etc/default/grub: the config file states what should boot, while /proc/cmdline proves the mitigation is active in the running kernel. Note some distributions build the kernel with CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, in which case the behaviour is on even without the parameter, but the explicit flag guarantees it.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )init_on_alloc=1( |$)/) }
end
describe command("grep -hwsF 'init_on_alloc=1' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains init_on_alloc=1. You can cross-check the build default with cat /sys/kernel/.../zcat /proc/config.gz | grep INIT_ON_ALLOC if available. The flag only appears after a reboot following a config change.
Inspect & investigate
No dedicated runtime log; this is a build/boot-time memory policy. Confirm via cat /proc/cmdline; kernel security/mitigation messages appear in dmesg.
Remediation
No automated remediation is wired for this rule (remediation is empty), so it must be applied manually: add init_on_alloc=1 to the kernel command line via the bootloader (e.g. GRUB_CMDLINE_LINUX in /etc/default/grub, then grub2-mkconfig) and reboot. Confirm with cat /proc/cmdline.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | init_on_alloc=1 |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Slight, usually negligible performance cost from zeroing every allocation (more noticeable on allocation-heavy workloads). Precautions: since RHEL 9 may already enable this by default at build time, adding the flag is harmless and idempotent. The change needs a reboot; verify the bootloader regenerated cleanly so you do not boot an unintended kernel line.