Disable vsyscall mapping
Requires the kernel to be built with CONFIG_LEGACY_VSYSCALL_NONE=y, removing the fixed-address vsyscall page entirely.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The legacy vsyscall page is a region mapped at a fixed, well-known virtual address in every process, a relic from before vDSO. Because its address never changes, it is a reliable target for ASLR-bypassing return-oriented programming (ROP): an attacker can chain gadgets from its known contents. Selecting CONFIG_LEGACY_VSYSCALL_NONE=y removes the mapping entirely, eliminating this fixed-address attack surface (the alternatives only emulate or execute-restrict it).
What Pavois checks
Pavois reads the build configuration of the running kernel, /boot/config-$(uname -r) and the in-memory /proc/config.gz, and confirms CONFIG_LEGACY_VSYSCALL_NONE=y. This is a choice group (none / xonly / emulate), so checking the booted kernel's real config establishes which variant is actually compiled in, not a stale /boot/config-*.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_X86_VSYSCALL_EMULATION=|CONFIG_LEGACY_VSYSCALL_NONE=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_X86_VSYSCALL_EMULATION=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_LEGACY_VSYSCALL' /boot/config-$(uname -r). Expected: CONFIG_LEGACY_VSYSCALL_NONE=y (and the XONLY/EMULATE variants marked is not set). At runtime, a kernel with vsyscall removed can also be confirmed via the boot parameter vsyscall=none in cat /proc/cmdline when used.
Inspect & investigate
No dedicated log. When a process touches the removed vsyscall page it receives a SIGSEGV; such faults appear in dmesg | grep -i -e vsyscall -e segfault or journalctl -k | grep -i vsyscall. The effective setting is also reflected by the kernel vsyscall= command line in cat /proc/cmdline.
Remediation
No automated remediation: this is a kernel build-time choice, not a runtime tunable. Pavois's harden plan is empty. To fix it you must boot a kernel built with CONFIG_LEGACY_VSYSCALL_NONE=y. On kernels that compiled in emulate/xonly you can approximate it at runtime with the vsyscall=none boot parameter, but the compile-time NONE choice this rule checks requires a different kernel.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the vsyscall page breaks only very old statically linked binaries (glibc older than ~2.14) that still call through the fixed vsyscall addresses; everything modern uses the vDSO and is unaffected. Audit for legacy static binaries before applying, if one exists, vsyscall=emulate is a less-secure compatibility fallback. Because the change requires a different kernel, keep the previous kernel entry in the bootloader.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.