Enable randomization of the page allocator
Requires the page_alloc.shuffle=1 kernel boot parameter to randomize the order in which the page allocator hands out free memory.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The kernel's free-page lists are otherwise handed out in a predictable order. If an attacker can crash the system (or trigger a fresh boot) and knows the deterministic allocation order, they can predict where sensitive data will land in physical memory and shape a heap-grooming or memory-disclosure attack. page_alloc.shuffle=1 randomizes the order in which free pages are served (a feature originally added to improve direct-mapped cache utilization), so allocations become unpredictable across boots regardless of the cache architecture.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline and checks for page_alloc.shuffle=1. This is the boot line the running kernel parsed, not a GRUB file that might be edited but not regenerated. You can confirm the feature is actually active at runtime via /sys/module/page_alloc/parameters/shuffle.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )page_alloc\.shuffle=1( |$)/) }
end
describe command("grep -hwsF 'page_alloc\.shuffle=1' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains page_alloc.shuffle=1. Cross-check the runtime state with:
cat /sys/module/page_alloc/parameters/shuffle
Expected output is Y.
Inspect & investigate
Runtime state is exposed at /sys/module/page_alloc/parameters/shuffle. There is no dedicated log; the boot line itself (dmesg | grep -i command shows the parsed /proc/cmdline) is the authoritative trace.
Remediation
pavois harden apply uses the kernel_cmdline resource to add page_alloc.shuffle=1 to the bootloader configuration and regenerate it, so the option is present on next boot. A reboot is required to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | page_alloc.shuffle=1 |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This parameter is low-risk: page-allocator shuffling has negligible performance impact and on many platforms even slightly improves cache utilization. The only practical caveat:
- It applies after a reboot, so schedule the change with a maintenance window.
- No application compatibility concerns; it is a pure memory-layout randomization with no functional behavior change.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.