Enable SLUB/SLAB allocator poisoning
Requires the slub_debug=P kernel boot parameter so the SLUB allocator poisons freed objects, catching use-after-free and scrubbing leftover data.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
slub_debug=P enables poisoning of SLUB allocator objects: a known pattern is written into objects as they are freed, so any read or write to an object after it is freed (or before it is re-initialized) is detected and prevented. This neutralizes many use-after-free vulnerabilities at little performance cost, and additionally scrubs sensitive data left in freed objects so it cannot leak to the next allocation. The P flag enables only poisoning (not the full, costlier debug suite).
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline and checks for slub_debug=P. This is the boot line the running kernel parsed, not /etc/default/grub, a GRUB edit never regenerated would falsely pass a file scan while object poisoning is still off at runtime. Per-cache state is visible under /sys/kernel/slab/*/.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )slub_debug=P( |$)/) }
end
describe command("grep -hwsF 'slub_debug=P' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains slub_debug=P. You can confirm poisoning is active on a cache by reading its sysfs attribute, e.g.:
cat /sys/kernel/slab/kmalloc-64/poison
Expected output is 1.
Inspect & investigate
A poison/redzone violation is reported in the kernel ring buffer as a SLUB corruption message, inspect dmesg | grep -iE 'slab|slub|poison' or journalctl -k | grep -iE 'slub|poison'. Per-cache state lives under /sys/kernel/slab/.
Remediation
pavois harden apply uses the kernel_cmdline resource to add slub_debug=P to the bootloader configuration and regenerate it, so the option is present on next boot. A reboot is required to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | slub_debug=P |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Object poisoning adds a small CPU cost for the overwrite/check on alloc and free, and disables slab cache merging (the P flag implies per-cache debug), slightly raising kernel memory usage. Precautions:
- On memory-churn-heavy or latency-critical workloads, benchmark to confirm the overhead is acceptable.
- It can surface pre-existing buggy drivers that touch freed memory by triggering corruption reports, validate on a non-critical node first.
- Applies after reboot only, schedule a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.