Enforce Spectre v2 mitigation
Enforces the kernel parameter spectre_v2=on to apply the strongest available Spectre v2 (branch target injection) CPU mitigation.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The Spectre v2 vulnerability (branch target injection / CVE-2017-5715) lets an attacker steer the CPU's speculative execution to read memory they should not have access to, leaking kernel or cross-process secrets through a side channel. Setting spectre_v2=on forces the strongest available mitigation (e.g. retpolines / IBRS / IBPB) instead of the kernel's default auto, which may leave gaps depending on microcode and CPU.
What Pavois checks
Pavois reads the effective boot command line from /proc/cmdline, which is exactly what the running kernel was booted with. Grepping /etc/default/grub or grub.cfg is unreliable: edits may not be regenerated, drop-ins under /etc/default/grub.d/ can override them, and the file may not match the actual bootloader entry. Only /proc/cmdline proves the mitigation is enforced on this boot.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )spectre_v2=on( |$)/) }
end
describe command("grep -hwsF 'spectre_v2=on' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains spectre_v2=on. Cross-check the live CPU state with cat /sys/devices/system/cpu/vulnerabilities/spectre_v2, which should report a mitigation (e.g. Mitigation: Retpolines) rather than Vulnerable.
Inspect & investigate
Use dmesg | grep -i spectre or journalctl -k | grep -i spectre to see the kernel's boot-time report of the chosen mitigation. The resolved status is exposed continuously via the sysfs entry /sys/devices/system/cpu/vulnerabilities/spectre_v2.
Remediation
Pavois's harden plan uses the kernel_cmdline resource to add spectre_v2=on to the bootloader configuration and regenerate it. As a boot-time parameter, reboot_required is true and the change applies only after the next reboot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | spectre_v2=on |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving Spectre v2 unmitigated keeps the host open to cross-privilege memory disclosure. Forcing spectre_v2=on can carry a noticeable performance penalty on syscall- and context-switch-heavy workloads (retpolines/IBRS), and it requires a reboot. Precautions: benchmark performance-sensitive services first, schedule the reboot in a maintenance window, confirm the bootloader regenerated (grubby --info=ALL on RHEL or inspect grub.cfg), and keep console/IPMI access in case the system fails to boot cleanly.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.