Enable automatic signing of all modules
Requires the running kernel to be built with CONFIG_MODULE_SIG_ALL=y so that every module is automatically signed during the build/install process.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CONFIG_MODULE_SIG_ALL=y makes the kernel build process sign every module automatically during make modules_install. Without it, modules ship unsigned (or only some are signed), so enforcement (CONFIG_MODULE_SIG_FORCE) would reject legitimate modules and signature verification is effectively incomplete. Signing all modules at build time guarantees a consistent, fully verifiable module set and is what makes mandatory signing usable in practice.
What Pavois checks
Pavois reads the build-time config of the running kernel via /boot/config-$(uname -r), falling back to /proc/config.gz from the live kernel, so the answer reflects the kernel actually booted. Pavois expects CONFIG_MODULE_SIG_ALL=y.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_MODULE_SIG_ALL=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_MODULE_SIG_ALL=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_MODULE_SIG_ALL=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep '^CONFIG_MODULE_SIG_ALL='). Expected output: CONFIG_MODULE_SIG_ALL=y.
Inspect & investigate
Inspect individual modules with modinfo <module>, a signed module reports sig_id, signer and sig_key fields. dmesg | grep -i module and journalctl -k reveal load-time signature warnings or rejections.
Remediation
No automated remediation: CONFIG_MODULE_SIG_ALL is a kernel build-time option decided when the kernel is compiled. It cannot be set at runtime. Use a distribution kernel that signs all its modules, or rebuild the kernel with this option. Apply manually; pavois harden apply cannot change a compiled-in setting.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If not all modules are signed, enabling enforcement would reject legitimate kernel modules and could break drivers or even prevent boot. Conversely, leaving it off undermines mandatory module signing. There is no runtime risk to the check itself; the precaution applies to the broader signing chain: when moving to enforced signing, confirm every in-use module is signed (modinfo shows signature fields) before enabling CONFIG_MODULE_SIG_FORCE, and keep recovery/console access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R18 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.