Poison kernel stack before returning from syscalls
Requires the kernel to be built with CONFIG_GCC_PLUGIN_STACKLEAK=y, a GCC plugin that erases (poisons) the kernel stack on return from each syscall.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
This blocks most uninitialized stack variable attacks, with the performance impact being driven by the depth of the stack usage, rather than the function calling complexity.
What Pavois checks
Pavois reads the effective build flag of the running kernel via /boot/config-$(uname -r) or /proc/config.gz, keyed on $(uname -r), so it reflects the booted image rather than a stray .config a fixed-path file scan might match.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_GCC_PLUGIN_STACKLEAK=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_GCC_PLUGIN_STACKLEAK=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_GCC_PLUGIN_STACKLEAK=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_GCC_PLUGIN_STACKLEAK='). Expected output: CONFIG_GCC_PLUGIN_STACKLEAK=y. Absent or # ... is not set is a failure. When active, /proc/sys/kernel/stack_erasing exists and reads 1.
Inspect & investigate
STACKLEAK reports detected stack-depth overflows to the ring buffer: dmesg | grep -i stackleak or journalctl -k. Runtime state is exposed at /proc/sys/kernel/stack_erasing. Confirm the build flag with zcat /proc/config.gz | grep STACKLEAK.
Remediation
No automated remediation is shipped: a kernel build option cannot be set by editing a file. Apply it manually by installing and booting a kernel compiled with CONFIG_GCC_PLUGIN_STACKLEAK=y.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
When a syscall returns, the kernel stack it used still holds leftover data, pointers, secrets, canaries. A later syscall whose code reads an uninitialized local variable can disclose that stale data to userspace (an info leak that defeats ASLR/KASLR) or be steered to use attacker-influenced leftovers. The STACKLEAK plugin overwrites the used portion of the stack with a poison value before returning to userspace, eliminating both the info-leak and the stale-data reuse class. It also detects stack-depth overflows. Without it, uninitialized-stack-variable attacks remain viable. This is a build-time option needing GCC plugin support, set only by booting a kernel compiled with it. Precautions: there is a runtime cost proportional to stack depth (usually a few percent); switching to a hardened kernel changes module ABI, so validate driver loading and benchmark latency-sensitive workloads off production. No reboot risk beyond a normal kernel swap.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R21 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.