Enable checks on scatter-gather (SG) table operations
Requires the kernel to be built with CONFIG_DEBUG_SG=y, which adds runtime sanity checks on scatter-gather DMA table operations.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
This can help find problems with drivers that do not properly initialize their SG tables.
What Pavois checks
Pavois reads the effective build flag of the running kernel via /boot/config-$(uname -r) or /proc/config.gz, keyed on $(uname -r). It therefore reflects the kernel actually booted, not a stale .config from a build tree or another installed image that a fixed-path file scan might pick up.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_DEBUG_SG=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_DEBUG_SG=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_DEBUG_SG=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_DEBUG_SG='). Expected output: CONFIG_DEBUG_SG=y. Absent or # CONFIG_DEBUG_SG is not set means the rule is not satisfied.
Inspect & investigate
When the check trips on a bad SG table, the kernel emits a warning to the ring buffer: dmesg | grep -i 'sg\|scatter' or journalctl -k. The config flag itself is silent; confirm presence with zcat /proc/config.gz | grep DEBUG_SG.
Remediation
No automated remediation is shipped: a kernel build option cannot be set by editing a file. Apply it manually by installing and booting a kernel compiled with CONFIG_DEBUG_SG=y.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Scatter-gather (SG) tables describe the memory regions a driver hands to the DMA engine. A driver that builds a malformed SG table can make a device read or write the wrong physical memory, corrupting kernel data silently or enabling DMA-based memory corruption. CONFIG_DEBUG_SG adds magic-number and bounds checks that trap such bugs at the point they happen instead of letting them propagate. This is a build-time option, changeable only by booting a kernel compiled with it. Precautions: it costs a small amount of runtime overhead and is typically off in stock kernels; adopting a hardened kernel changes module ABI, so validate driver loading and run a soak test off production before deploying. No special reboot risk beyond a normal kernel swap.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R16 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.