Disable compatibility with brk()
Ensures the running kernel is built without CONFIG_COMPAT_BRK, so heap (brk) randomization stays active as part of ASLR.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CONFIG_COMPAT_BRK=y keeps a legacy compatibility behavior for ancient binaries that places the program's heap (brk) at a fixed, predictable location, which disables heap randomization, a core part of ASLR. Predictable heap addresses make heap-overflow and use-after-free exploits dramatically easier, since the attacker no longer has to defeat randomization. Leaving it unset (the secure value) preserves full ASLR for the heap.
What Pavois checks
Pavois reads the build-time config of the running kernel via /boot/config-$(uname -r) (fallback /proc/config.gz) and asserts the line is not CONFIG_COMPAT_BRK=y. Keying on uname -r matches the exact booted image, more reliable than reading a random /boot/config-*. Note this is independent of the runtime kernel.randomize_va_space sysctl, which controls the broader ASLR policy.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_COMPAT_BRK=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_COMPAT_BRK=y$/) }
endHow to verify it is applied
Run grep -h '^CONFIG_COMPAT_BRK=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep COMPAT_BRK). Expected: # CONFIG_COMPAT_BRK is not set or no output. You can also confirm overall ASLR is active with sysctl kernel.randomize_va_space (should be 2).
Inspect & investigate
Static kernel build option, no runtime log. Inspect with zcat /proc/config.gz | grep COMPAT_BRK or grep COMPAT_BRK /boot/config-$(uname -r). To observe ASLR in action, compare cat /proc/self/maps across runs (heap base should vary) or check sysctl kernel.randomize_va_space.
Remediation
No automated remediation is shipped: this is a kernel compile-time option. Apply it by booting a kernel built without CONFIG_COMPAT_BRK (the modern default), or rebuild the kernel. pavois harden apply cannot change it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if enabled: heap randomization is disabled, making heap-corruption exploits far easier by giving the attacker predictable addresses.
Precautions before changing it: disabling COMPAT_BRK only affects extremely old, statically-linked binaries that assumed a fixed heap layout (libc5-era), virtually none exist on modern systems, so functional impact is essentially nil. Changing kernels requires a reboot; keep the previous kernel in GRUB as a fallback and validate boot on a console.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R17 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.