Disable the LDT (local descriptor table)
Requires the kernel to be built without CONFIG_MODIFY_LDT_SYSCALL=y, removing the modify_ldt() syscall and per-process LDT support.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CONFIG_MODIFY_LDT_SYSCALL enables the modify_ldt() syscall, which lets a process install custom segment descriptors in a per-process Local Descriptor Table. This legacy x86 mechanism (used by old 16-bit/segmented code and some sandboxes) has a long history of kernel vulnerabilities and privilege-escalation exploits. Modern 64-bit userspace almost never needs it, so building the kernel without CONFIG_MODIFY_LDT_SYSCALL removes an unnecessary, exploit-prone syscall and shrinks attack surface.
What Pavois checks
Pavois reads the build configuration of the running kernel, /boot/config-$(uname -r) and the in-memory /proc/config.gz, and confirms CONFIG_MODIFY_LDT_SYSCALL is not set to y. Reading the booted kernel's real config (not a stale /boot/config-*) reflects whether the modify_ldt() syscall is actually compiled in.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_MODIFY_LDT_SYSCALL=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_MODIFY_LDT_SYSCALL=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_MODIFY_LDT_SYSCALL=' /boot/config-$(uname -r). Expected: no match, or # CONFIG_MODIFY_LDT_SYSCALL is not set, the line CONFIG_MODIFY_LDT_SYSCALL=y must be absent. On a kernel that compiled it in but disabled it at runtime, sysctl kernel.modify_ldt returns 0.
Inspect & investigate
No dedicated log. When the syscall is unavailable, callers get ENOSYS. On kernels built with it, the runtime gate is sysctl kernel.modify_ldt (0 = disabled). Programs attempting to use it can be traced with strace -e trace=modify_ldt <cmd>.
Remediation
No automated remediation: this is a kernel build-time option, not a runtime tunable. Pavois's harden plan is empty. To fully remove the syscall you must boot a kernel compiled without CONFIG_MODIFY_LDT_SYSCALL. As a runtime mitigation on kernels that ship it, set kernel.modify_ldt=0 via sysctl, but that does not remove the syscall this rule targets.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing modify_ldt() breaks the rare software that depends on a custom LDT: DOSEMU/old Wine 16-bit code, some legacy segmented or JIT sandboxes. Audit for such workloads before applying. Because the change requires a different kernel, keep the previous kernel entry in the bootloader so you can fall back if a dependent application is found.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R25 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.