Disable merging of slabs with similar size
Requires the slab_nomerge kernel boot parameter so slab caches of similar size are kept isolated instead of merged, containing kernel heap overflows.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
To save memory, the kernel by default merges slab caches of similar object size into a shared cache. This means a seemingly harmless but vulnerable cache can end up sharing memory with a valuable one, so a heap overflow in one object type can overwrite objects from another merged cache. slab_nomerge keeps every cache isolated: a heap overflow then only affects objects in the same cache, shrinking the kernel heap attack surface and making exploitation harder.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline and checks for the slab_nomerge token. This is the boot line the running kernel parsed, not /etc/default/grub, a GRUB edit that was never regenerated would falsely pass a file scan while caches are still merged at runtime.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )slab_nomerge( |$)/) }
end
describe command("grep -hwsF 'slab_nomerge' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains a standalone slab_nomerge token. You can observe the effect in the slab listing, cat /proc/slabinfo shows distinct, unmerged cache names rather than shared kmalloc-*-style aliases.
Inspect & investigate
There is no dedicated log; the active state is reflected by the boot line in /proc/cmdline and by the cache layout in /proc/slabinfo. Slab corruption, when detected, is reported in the kernel ring buffer, dmesg | grep -i slab.
Remediation
pavois harden apply uses the kernel_cmdline resource to add slab_nomerge to the bootloader configuration and regenerate it, so the option is present on next boot. A reboot is required to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | slab_nomerge |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling slab merging increases kernel memory usage modestly because caches can no longer share backing memory. Precautions:
- On very memory-constrained hosts, account for the slightly higher slab footprint.
- No functional or application compatibility impact; it is a pure hardening trade-off (security vs. a little RAM).
- Applies after reboot only, schedule a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.