Configure L1 Terminal Fault mitigations
Ensures the kernel booted with l1tf=full,force, enabling the strongest L1 Terminal Fault mitigation including unconditional SMT/hyper-threading control.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
L1TF (L1 Terminal Fault, a.k.a. Foreshadow) is a speculative-execution vulnerability that lets an attacker read any physical memory cached in the L1 data cache, bypassing memory-access controls enforced by the OS or hypervisor. On a shared host or virtualisation platform this enables cross-VM / cross-guest secret theft. l1tf=full,force applies full mitigation and forces it even when the kernel would otherwise consider it unnecessary, and disables vulnerable SMT sharing, the configuration mandated by ANSSI BP-028 R8 for affected Intel CPUs.
What Pavois checks
Pavois reads /proc/cmdline, the line the running kernel booted with, and checks for l1tf=full,force. This is decisive over reading /etc/default/grub: the config file is only intent for the next boot, whereas /proc/cmdline proves the mitigation is active in the running kernel. Cross-check the effective state with /sys/devices/system/cpu/vulnerabilities/l1tf, which reports what mitigation is genuinely in force.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )l1tf=full( |$)/) }
end
describe command("grep -hwsF 'l1tf=full' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm l1tf=full,force is present, then cat /sys/devices/system/cpu/vulnerabilities/l1tf should report mitigation active (e.g. Mitigation: PTE Inversion; VMX: cache flushes, SMT disabled). The flag only appears after a reboot.
Inspect & investigate
The effective mitigation is reported by cat /sys/devices/system/cpu/vulnerabilities/l1tf. Kernel mitigation/SMT messages appear in dmesg (dmesg | grep -i -e l1tf -e smt).
Remediation
pavois harden apply uses the kernel_cmdline resource to add l1tf=full,force to the bootloader (GRUB) configuration and regenerate it. Flagged reboot_required: the mitigation only takes effect, and appears in /proc/cmdline, after the next restart.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | l1tf=full |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Significant performance trade-off: full,force can disable SMT/hyper-threading, which may cut throughput on CPU-bound and heavily virtualised workloads, plan for capacity loss. Precautions: on AMD CPUs (not affected by L1TF) the option is effectively a no-op; on modern Intel CPUs with hardware fixes it may be unnecessary. Validate the actual state via /sys/.../vulnerabilities/l1tf rather than assuming. Requires a reboot; verify the bootloader regenerated cleanly to avoid booting an unintended kernel line.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.