Harden slab freelist metadata
Requires the kernel to be built with CONFIG_SLAB_FREELIST_HARDENED=y, obfuscating and validating slab freelist pointers.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Many kernel heap exploits target slab cache metadata. CONFIG_SLAB_FREELIST_HARDENED=y obfuscates the slab allocator's freelist pointers (XOR-ing them with a per-cache secret and the pointer location) and adds sanity checks, so an attacker who corrupts a freed object can no longer reliably forge a freelist pointer to redirect allocations to an arbitrary address. The cost is a minor performance overhead.
What Pavois checks
Pavois reads the build configuration of the running kernel via /boot/config-$(uname -r) or /proc/config.gz and confirms CONFIG_SLAB_FREELIST_HARDENED=y. Reading the live kernel's effective config, not a packaged or default file, proves the hardening is actually compiled into the kernel that booted, not merely present in an installed-but-unbooted image.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_SLAB_FREELIST_HARDENED=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_SLAB_FREELIST_HARDENED=y$/) }
endHow to verify it is applied
grep '^CONFIG_SLAB_FREELIST_HARDENED=' /boot/config-$(uname -r) || zcat /proc/config.gz | grep '^CONFIG_SLAB_FREELIST_HARDENED='
Expected output: CONFIG_SLAB_FREELIST_HARDENED=y.
Inspect & investigate
This is a static build-time protection with no dedicated log stream. When the hardening detects corruption it triggers a kernel panic or BUG; inspect dmesg or journalctl -k for slab/freelist corruption messages. Confirm the option with the grep command above.
Remediation
No automated remediation is shipped: CONFIG_SLAB_FREELIST_HARDENED is a compile-time kernel option and cannot be toggled at runtime. The fix is to boot a kernel built with it enabled, the stock distribution kernels for the supported OSes already do. If you build a custom kernel, set CONFIG_SLAB_FREELIST_HARDENED=y and rebuild.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving this off makes slab/heap exploitation substantially easier, since freelist pointers can be forged predictably. Precautions: the only remedy is a kernel change, which requires a reboot, schedule a maintenance window and keep the previous kernel in GRUB as a fallback. The runtime cost is small (a few percent on allocation-heavy workloads); benchmark latency-sensitive services if relevant, but for nearly all systems the security gain outweighs it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R17 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.