zero-init everything passed by reference
Requires the kernel to be built with CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y, the strongest structleak mode, which zero-initializes every local variable whose address is taken.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
This eliminates all classes of uninitialized stack variable exploits and information exposures.
What Pavois checks
Pavois reads the effective build flag of the running kernel via /boot/config-$(uname -r) or /proc/config.gz, keyed on $(uname -r), so it reflects the booted image rather than a stray .config a fixed-path file scan might match.
describe command("grep -hE '^(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL|CONFIG_INIT_STACK_ALL_ZERO)=y' /boot/config-$(uname -r) 2>/dev/null; zcat /proc/config.gz 2>/dev/null | grep -E '^(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL|CONFIG_INIT_STACK_ALL_ZERO)=y'") do
its('stdout') { should match(/=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL='). Expected output: CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y. Absent or # ... is not set is a failure.
Inspect & investigate
This plugin is a compile-time transformation with no dedicated runtime log; its effect is the absence of info leaks. Confirm the flag with zcat /proc/config.gz | grep STRUCTLEAK_BYREF_ALL.
Remediation
No automated remediation is shipped: a kernel build option cannot be set by editing a file. Apply it manually by installing and booting a kernel compiled with CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A local kernel variable that is passed by reference to another function before being fully written can leak the uninitialized stack contents that occupied that memory, leftover pointers or secrets, to userspace or to an attacker-controlled path. The BYREF_ALL structleak mode zero-initializes every such by-reference local (not just aggregate structs), closing essentially the whole class of uninitialized-stack information exposures at the cost of more zeroing than the basic mode. Without it, a subset of these leaks remains exploitable. This is a build-time option needing GCC plugin support, set only by booting a kernel compiled with it. Precautions: it adds more runtime overhead than plain STRUCTLEAK because it zeroes more variables; switching to a hardened kernel changes module ABI, so validate driver loading and benchmark hot paths off production. No reboot risk beyond a normal kernel swap.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R21 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.