Disable kexec system call
Requires the kernel to be built without CONFIG_KEXEC=y, removing the kexec kernel-load-and-boot syscall.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
kexec lets a privileged process load and boot a new kernel image directly from the running one, skipping the firmware and bootloader. An attacker who reaches root can use it to boot an unsigned, malicious kernel, bypassing Secure Boot and module-signature enforcement, or to wipe forensic state. Building the kernel without CONFIG_KEXEC removes this kernel-replacement primitive entirely.
What Pavois checks
Pavois reads the build configuration of the running kernel, /boot/config-$(uname -r) and the in-memory /proc/config.gz, and confirms CONFIG_KEXEC is not set to y. Reading the booted kernel's real config (not a leftover /boot/config-*) reflects whether the kexec syscall is actually compiled in.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_KEXEC=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_KEXEC=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_KEXEC=' /boot/config-$(uname -r). Expected: no match, or # CONFIG_KEXEC is not set, the line CONFIG_KEXEC=y must be absent.
Inspect & investigate
kexec operations show up in the kernel log: dmesg | grep -i kexec or journalctl -k | grep -i kexec (e.g. kexec_core: Starting new kernel). A complementary runtime indicator is sysctl kernel.kexec_load_disabled, 1 means loading is locked until reboot even when the syscall is compiled in.
Remediation
No automated remediation: this is a kernel build-time option, not a runtime tunable. Pavois's harden plan is empty. To fully remove the capability you must boot a kernel compiled without CONFIG_KEXEC. As a runtime mitigation on kernels that ship it, you can set kernel.kexec_load_disabled=1 via sysctl (one-way, locks until reboot), but that does not remove the syscall this rule targets.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling kexec breaks any tooling that relies on it: kdump crash-dump capture (which boots a capture kernel via kexec), fast reboots in some orchestration setups, and live-patch fallback paths. Confirm you do not depend on kdump before removing the option. Because the change requires a different kernel, keep the previous kernel entry in the bootloader as a fallback.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R23 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.