Force kernel panic on uncorrected MCEs
Requires the mce=0 kernel boot parameter so an uncorrected Machine Check Exception triggers an immediate kernel panic instead of a recoverable SIGBUS.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
An uncorrected Machine Check Exception (MCE) signals memory or CPU corruption. By default the kernel tolerates such errors by sending a SIGBUS to the affected process and continuing to run. Leaving the system alive after corruption lets an attacker retry a hardware fault-injection attack (such as Rowhammer) repeatedly until a bit-flip lands in a useful location. Forcing a kernel panic on uncorrected MCEs (mce=0) turns each corruption event into a hard stop, removing the attacker's ability to iterate.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline and checks that mce=0 is present. /proc/cmdline is the effective boot line the running kernel actually parsed, not /etc/default/grub or a drop-in in /etc/default/grub.d/, which may have been edited without rebuilding the bootloader config. Reading the file would report a value that is not yet in effect; reading /proc/cmdline cannot be fooled.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )mce=0( |$)/) }
end
describe command("grep -hwsF 'mce=0' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm the output contains a standalone mce=0 token, for example:
BOOT_IMAGE=/vmlinuz ... mce=0 ...
Inspect & investigate
Machine Check events are logged by the kernel, inspect dmesg | grep -i mce or journalctl -k | grep -i mce. With mce=0, an uncorrected error appears as a panic in the kernel ring buffer just before the system halts.
Remediation
pavois harden apply uses the kernel_cmdline resource to add the mce=0 parameter to the bootloader configuration (GRUB) and regenerate it, so the option is present on the next boot. Because it is a boot parameter, a reboot is required for it to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | mce=0 |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
With mce=0, any uncorrected hardware error becomes a hard system halt instead of a recoverable event. On flaky or aging hardware this can turn isolated memory glitches into unexpected downtime. Precautions:
- Avoid on hosts with known marginal RAM/CPU; replace the hardware first.
- Validate on a non-critical node and ensure monitoring/auto-restart is in place before fleet-wide rollout.
- Keep a serial/console or out-of-band path so a panic is visible on headless machines.
- The change only applies after reboot, so schedule a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.