Disable IA32 emulation
Requires the kernel to be built without CONFIG_IA32_EMULATION=y, removing the 32-bit binary compatibility layer.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CONFIG_IA32_EMULATION lets a 64-bit kernel run 32-bit binaries through a compatibility layer that exposes the legacy int 0x80 syscall path and 32-bit ABI. This compatibility code is a recurring source of kernel vulnerabilities (it has hosted several privilege-escalation CVEs) and broadens the syscall attack surface for little benefit on modern systems. Building the kernel without it removes the 32-bit entry points entirely.
What Pavois checks
Pavois reads the build configuration of the running kernel, /boot/config-$(uname -r) and the in-memory /proc/config.gz, and confirms CONFIG_IA32_EMULATION is not set to y. Looking at the booted kernel's real config catches a vendor or custom kernel that still ships the compat layer even when userspace is fully 64-bit.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_IA32_EMULATION=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_IA32_EMULATION=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_IA32_EMULATION=' /boot/config-$(uname -r). Expected: no match, or # CONFIG_IA32_EMULATION is not set, the line CONFIG_IA32_EMULATION=y must be absent.
Inspect & investigate
There is no dedicated log. To find whether any 32-bit binaries are in use before disabling, inspect running processes with file /proc/*/exe 2>/dev/null | grep 'ELF 32-bit', or check loaded 32-bit libraries via find / -name '*.so*' -path '*i386*' 2>/dev/null. A kernel built without the option will return Exec format error when a 32-bit ELF is launched.
Remediation
No automated remediation: this is a kernel build-time option, not a runtime tunable. Pavois's harden plan is empty. To fix it you must boot a kernel compiled without CONFIG_IA32_EMULATION. Note that some distribution kernels expose a runtime switch (ia32_emulation=0 boot parameter on recent x86 kernels), use that if available, otherwise rebuild the custom kernel with the option unset and reboot.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling IA32 emulation makes the system unable to run any 32-bit (i386) binary, Steam, some proprietary tools, Wine 32-bit, or legacy in-house applications will fail to exec. Audit for 32-bit dependencies before applying. Because the change requires a different kernel, keep the previous kernel in the bootloader so you can fall back if a critical 32-bit workload is discovered.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R25 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.