Disable vsyscalls
Enforces the kernel parameter vsyscall=none to remove the legacy fixed-address vsyscall page from process memory.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The legacy vsyscall mechanism maps a small, fixed, executable region of kernel code at a predictable address in every process. Because its location is static, it provides a reliable target (ROP gadgets) for an attacker who already controls the return instruction pointer, weakening ASLR. Setting vsyscall=none removes this fixed mapping; modern glibc uses the vDSO instead and is unaffected.
What Pavois checks
Pavois reads the effective boot command line from /proc/cmdline, the arguments the running kernel truly started with. This is more reliable than grepping /etc/default/grub or grub.cfg, which may be edited without regeneration, overridden by drop-ins under /etc/default/grub.d/, or out of sync with the active bootloader entry. Only /proc/cmdline proves vsyscall=none is in force on this boot.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )vsyscall=none( |$)/) }
end
describe command("grep -hwsF 'vsyscall=none' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains vsyscall=none. On a hardened system, cat /proc/self/maps | grep vsyscall should no longer show an executable [vsyscall] mapping (or show it as --xp removed).
Inspect & investigate
Inspect the kernel ring buffer with dmesg | grep -i vsyscall to see how the kernel reports the vsyscall mode at boot. You can also confirm the absence of the legacy page per process via cat /proc/<pid>/maps | grep vsyscall.
Remediation
No automated harden plan is defined for this rule (remediation is empty), so it must be applied manually: add vsyscall=none to the kernel command line (e.g. via GRUB_CMDLINE_LINUX in /etc/default/grub then grub2-mkconfig, or grubby --update-kernel=ALL --args=vsyscall=none on RHEL) and reboot.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | vsyscall=none |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving the vsyscall page mapped gives attackers a stable, executable target that undermines ASLR. Disabling it requires a reboot and can break very old statically linked binaries or legacy glibc (pre-2.14) that still call vsyscalls directly, modern userspace using the vDSO is unaffected. Precautions: test legacy applications, prefer vsyscall=emulate first if you must support old binaries, schedule the reboot, and keep console access in case of boot issues.