Randomize layout of sensitive kernel structures
Requires the kernel to be built with CONFIG_GCC_PLUGIN_RANDSTRUCT=y, a GCC plugin that randomizes the field layout of sensitive kernel structures at build time.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Randomizing the layout of kernel data structures make it more difficult for an attacker to know the location of sensitive data.
What Pavois checks
Pavois reads the effective build flag of the running kernel via /boot/config-$(uname -r) or /proc/config.gz, keyed on $(uname -r), so it reflects the booted image rather than a stray .config a fixed-path file scan might match.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_RANDSTRUCT_FULL=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_RANDSTRUCT_FULL=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_GCC_PLUGIN_RANDSTRUCT=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_GCC_PLUGIN_RANDSTRUCT='). Expected output: CONFIG_GCC_PLUGIN_RANDSTRUCT=y. Absent or # ... is not set is a failure.
Inspect & investigate
No dedicated runtime log. A module built against a different seed fails to load with a disagrees about version of symbol / structure-layout error visible in dmesg or journalctl -k. Confirm the flag with zcat /proc/config.gz | grep RANDSTRUCT.
Remediation
No automated remediation is shipped: a kernel build option cannot be set by editing a file. Apply it manually by installing and booting a kernel compiled with CONFIG_GCC_PLUGIN_RANDSTRUCT=y.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Many kernel exploits rely on knowing the exact byte offset of a field inside a structure (for example a credentials or function-pointer field) so they can corrupt it precisely. CONFIG_GCC_PLUGIN_RANDSTRUCT reorders the members of selected sensitive structures with a per-build random seed, so those offsets differ from one kernel build to the next and are not known to an attacker who only has a generic exploit. Without it, structure layout is predictable and exploitation is easier. This is a build-time option requiring GCC plugin support; the randomization is fixed per build, set only by booting a kernel compiled with it. Precautions: out-of-tree modules must be compiled against the same RANDSTRUCT seed as the kernel or they will fail to load with structure-mismatch errors, this is the main operational gotcha. Validate every needed driver loads on the target kernel off production before deploying. No reboot risk beyond a normal kernel swap.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R21 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.