Configure the confidence in TPM for entropy
Requires the rng_core.default_quality=500 kernel boot parameter so the kernel credits a moderate amount of entropy from hardware RNGs (e.g. a TPM) to avoid entropy starvation at boot.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Early in boot a system can starve for entropy, blocking cryptographic operations (key generation, TLS, getrandom()) until the random pool is seeded. rng_core.default_quality=500 tells the kernel to credit entropy from hardware RNGs (such as a TPM) at a moderate confidence level, helping fill the pool faster so the system reaches a usable cryptographic state sooner. A non-zero value below the maximum strikes a balance between availability and not fully trusting a single hardware source.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline and checks for rng_core.default_quality=500. This is the boot line the running kernel parsed, not /etc/default/grub, a file edit never regenerated would falsely pass while the running kernel still credits zero entropy from hardware. The runtime value is exposed at /sys/module/rng_core/parameters/default_quality.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )rng_core\.default_quality=500( |$)/) }
end
describe command("grep -hwsF 'rng_core\.default_quality=500' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains rng_core.default_quality=500. Cross-check the runtime value with:
cat /sys/module/rng_core/parameters/default_quality
Expected output is 500.
Inspect & investigate
Hardware RNG activity is logged at boot, dmesg | grep -i 'hwrng\|rng' or journalctl -k | grep -i rng. Entropy pool readiness can be observed via cat /proc/sys/kernel/random/entropy_avail.
Remediation
pavois harden apply uses the kernel_cmdline resource to add rng_core.default_quality=500 to the bootloader configuration and regenerate it, so the option is present on next boot. A reboot is required to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | rng_core.default_quality=500 |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
This parameter is low-risk and generally improves boot reliability for crypto-dependent services. Precautions:
- It credits entropy from the hardware RNG / TPM; on hosts without a trustworthy hardware source the credited quality is a trust assumption, keep the value moderate (500/1000) rather than maxing it out.
- No application impact; it only affects how fast the random pool becomes ready.
- Applies after reboot only, schedule a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.