Perform full reference count validation
Requires the kernel to be built with CONFIG_REFCOUNT_FULL=y so all refcount_t operations are fully validated and saturate on overflow.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Refcounting provides protections against various use-after-free conditions that can be used in security flaw exploits. With CONFIG_REFCOUNT_FULL, the kernel performs full sanity checking of refcount_t operations and saturates instead of wrapping, so a counter that overflows (often forced by an attacker) cannot reach zero prematurely and trigger an early free of a still-referenced object, a classic path to use-after-free privilege escalation. Note: on newer kernels (5.5+) this protection is always built into the arithmetic and the dedicated option was removed, so the check is most meaningful on the older kernels in scope.
What Pavois checks
Pavois reads the build options of the running kernel, grep '^CONFIG_REFCOUNT_FULL=' /boot/config-$(uname -r) or zcat /proc/config.gz, and requires y. Reading the live kernel's own config (keyed on uname -r) reflects exactly the booted kernel, which a package name or generic file cannot guarantee.
only_if('option exists (removed in kernel >= 5.5)') { command('grep -q REFCOUNT_FULL /boot/config-$(uname -r)').exit_status == 0 }
describe command("grep -h '^CONFIG_REFCOUNT_FULL=' /boot/config-$(uname -r) 2>/dev/null; zcat /proc/config.gz 2>/dev/null | grep '^CONFIG_REFCOUNT_FULL='") do
its('stdout') { should match(/^CONFIG_REFCOUNT_FULL=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_REFCOUNT_FULL=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep CONFIG_REFCOUNT_FULL). Expected output:
CONFIG_REFCOUNT_FULL=y
On kernels 5.5 and newer the symbol no longer exists because full refcount checking is unconditional.
Inspect & investigate
There is no routine log entry. A refcount violation is reported at runtime via a kernel warning in dmesg / journalctl -k (look for refcount_t overflow/underflow WARNING traces). Confirm the build flag with grep CONFIG_REFCOUNT_FULL /boot/config-$(uname -r).
Remediation
This is a kernel build-time option, so Pavois ships no automated harden step for it. It is satisfied by booting a distribution kernel compiled with CONFIG_REFCOUNT_FULL=y, or by running a kernel 5.5+ where the protection is always on; a custom kernel must be rebuilt.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If absent (on a kernel old enough to expose the option), refcount_t overflows can silently wrap and enable use-after-free exploitation. Precautions: full refcount checking adds a tiny per-operation cost but is enabled in stock kernels and safe to adopt. On modern kernels (5.5+) there is nothing to change, the check intentionally finds the symbol missing because the behavior is built in. No reboot risk beyond the normal kernel switch.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.