Do not allow usercopy whitelist violations to fallback to object size
Requires the kernel to be built without CONFIG_HARDENED_USERCOPY_FALLBACK=y, so usercopy allow-list violations are blocked rather than allowed with a warning.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When CONFIG_HARDENED_USERCOPY_FALLBACK=y, a usercopy that violates a slab cache's allow-list is permitted anyway (only a warning is logged) and validated against the coarse object size instead. This soft-fail mode was a migration aid; leaving it on weakens hardened usercopy back toward an advisory check, so a heap object that should never be copied to userspace can still leak its full contents. Disabling the fallback turns violations into hard rejections, restoring the full protection of CONFIG_HARDENED_USERCOPY.
What Pavois checks
Pavois reads the build configuration of the running kernel, /boot/config-$(uname -r) and the in-memory /proc/config.gz, and confirms CONFIG_HARDENED_USERCOPY_FALLBACK is not set to y. Inspecting the booted kernel's config (not a leftover /boot/config-*) ensures the answer reflects the kernel actually enforcing usercopy checks.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_HARDENED_USERCOPY_FALLBACK=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_HARDENED_USERCOPY_FALLBACK=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_HARDENED_USERCOPY_FALLBACK=' /boot/config-$(uname -r). Expected: no match, or # CONFIG_HARDENED_USERCOPY_FALLBACK is not set, the line CONFIG_HARDENED_USERCOPY_FALLBACK=y must be absent.
Inspect & investigate
With the fallback enabled, violations only warn, look for usercopy: Whitelist mismatch or Bad or missing usercopy whitelist in dmesg | grep -i usercopy / journalctl -k | grep -i usercopy. With the fallback disabled, those same violations escalate to hard faults visible in the kernel log.
Remediation
No automated remediation: this is a kernel build-time option, not a runtime tunable. Pavois's harden plan is empty. To fix it you must boot a kernel compiled without CONFIG_HARDENED_USERCOPY_FALLBACK, current distribution kernels already disable it; for a custom kernel, unset the option and rebuild, then reboot.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving the fallback enabled degrades hardened usercopy to advisory mode, so kernel memory disclosures that should be blocked are merely logged. Disabling it is purely a hardening tightening and breaks no legitimate workload, but it requires booting a different kernel: keep the previous kernel entry in the bootloader and confirm the new kernel boots cleanly before decommissioning the old one.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.