Harden common str/mem functions against buffer overflows
Requires the kernel to be built with CONFIG_FORTIFY_SOURCE=y, adding compile- and run-time bounds checks to common str*/mem* functions.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
This features helps reduce likelihood of memory corruption of kernel structures.
What Pavois checks
Pavois reads the effective build flag of the running kernel via /boot/config-$(uname -r) or /proc/config.gz, keyed on $(uname -r), so it reflects the booted image rather than a stray .config a fixed-path file scan might match.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_FORTIFY_SOURCE=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_FORTIFY_SOURCE=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_FORTIFY_SOURCE=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_FORTIFY_SOURCE='). Expected output: CONFIG_FORTIFY_SOURCE=y. Absent or # CONFIG_FORTIFY_SOURCE is not set is a failure.
Inspect & investigate
When a fortified function detects an overflow, the kernel logs detected buffer overflow in <func> and panics: see dmesg or journalctl -k | grep -i 'buffer overflow'. The build flag itself is silent; confirm it with zcat /proc/config.gz | grep FORTIFY_SOURCE.
Remediation
No automated remediation is shipped: a kernel build option cannot be set by editing a file. Apply it manually by installing and booting a kernel compiled with CONFIG_FORTIFY_SOURCE=y.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
memcpy, strcpy, strcat and friends are the classic source of buffer overflows: when the destination size is known at compile time, an oversized copy silently smashes adjacent kernel memory, which attackers leverage for privilege escalation. CONFIG_FORTIFY_SOURCE inserts size checks so an overflow is caught and turned into a controlled kernel panic instead of a corrupted, exploitable state. Without it, a whole class of kernel memory-corruption bugs stays silently exploitable. This is a build-time option, set only by booting a kernel compiled with it. Precautions: stock distribution kernels increasingly enable it by default; switching to a hardened kernel changes module ABI, so validate driver loading and watch dmesg for detected buffer overflow panics (which indicate a real bug being caught, not a false alarm) during a soak test off production. No reboot risk beyond a normal kernel swap.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.