← All rules
SOCLE-CLD-KRN-034// Kernel buildmediumeffective runtime

Generate some entropy during boot and runtime

Requires the kernel to be built with CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y, a GCC plugin that mixes extra entropy into the kernel's random pool during boot and runtime.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

This helps generate entropy during startup and is particularly relevant for devices with inappropriate entropy sources.

What Pavois checks

Pavois reads the effective build flag of the running kernel via /boot/config-$(uname -r) or /proc/config.gz, keyed on $(uname -r), so it reflects the booted image rather than a stray .config a fixed-path file scan might match.

describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_GCC_PLUGIN_LATENT_ENTROPY=|PAVOIS_NO_KERNEL_CONFIG)'") do
  its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
  its('stdout') { should match(/^CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y$/) }
end

How to verify it is applied

Run grep '^CONFIG_GCC_PLUGIN_LATENT_ENTROPY=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_GCC_PLUGIN_LATENT_ENTROPY='). Expected output: CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y. Absent or # ... is not set is a failure.

Inspect & investigate

This plugin has no dedicated runtime log; its effect is on entropy quality. Inspect entropy with cat /proc/sys/kernel/random/entropy_avail and confirm the flag with zcat /proc/config.gz | grep LATENT_ENTROPY.

Remediation

No automated remediation is shipped: a kernel build option cannot be set by editing a file. Apply it manually by installing and booting a kernel compiled with CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y.

Pavois applies this with its own harden engine, the plan below, not a shell script:

resourcekernel_build
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Early in boot the kernel's random pool is starved of entropy, which is exactly when keys, ASLR offsets and stack canaries are seeded. On headless servers, VMs and embedded devices that lack rich hardware noise sources, weak early randomness makes those secrets more predictable, undermining ASLR and cryptographic material. The latent-entropy GCC plugin instruments selected functions to extract and feed timing/state entropy into the pool, improving early randomness. Missing it weakens this defense, especially on virtualized or embedded hosts. This is a build-time option requiring GCC plugin support, set only by booting a kernel compiled with it. Precautions: it has a measurable but small compile-time and runtime cost and needs a plugin-capable toolchain; switching to a hardened kernel changes module ABI, so validate driver loading off production. No reboot risk beyond a normal kernel swap.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R21direct2.0high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references

Official standards

ANSSI-BP-028 (2.0) ↗