Disallow merge of slab caches
Requires the kernel not to merge slab caches by default (CONFIG_SLAB_MERGE_DEFAULT is not y), keeping unrelated object types isolated.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
By default the kernel merges slab caches of similar size to save memory. Merging mixes unrelated kernel objects into the same cache, so a heap overflow in one object type can corrupt objects of a completely different, security-sensitive type. Keeping caches separate (CONFIG_SLAB_MERGE_DEFAULT not set to y, or slab_nomerge on the boot line) isolates an overflow to objects of the same type, shrinking the kernel's attack surface.
What Pavois checks
Pavois reads the build configuration of the running kernel via /boot/config-$(uname -r) or /proc/config.gz and confirms CONFIG_SLAB_MERGE_DEFAULT is not set to y (the compliant value is n/unset). Reading the effective config of the booted kernel proves whether merging is the default for the kernel actually running. Note that the slab_nomerge boot parameter can also disable merging at runtime regardless of this build default.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_SLAB_MERGE_DEFAULT=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_SLAB_MERGE_DEFAULT=y$/) }
endHow to verify it is applied
grep '^CONFIG_SLAB_MERGE_DEFAULT=' /boot/config-$(uname -r) || zcat /proc/config.gz | grep '^CONFIG_SLAB_MERGE_DEFAULT='
Compliant if the result is CONFIG_SLAB_MERGE_DEFAULT=n, the line is absent, or the kernel boots with slab_nomerge (check cat /proc/cmdline). A result of CONFIG_SLAB_MERGE_DEFAULT=y without slab_nomerge is non-compliant.
Inspect & investigate
This is a static build/boot configuration with no dedicated log stream. Inspect the boot command line with cat /proc/cmdline to see whether slab_nomerge is active, and confirm the build default with the grep command above.
Remediation
No automated remediation is shipped. The build default CONFIG_SLAB_MERGE_DEFAULT cannot be changed at runtime, but you can override merging without rebuilding by adding the slab_nomerge parameter to the kernel boot line (e.g. via your bootloader's GRUB_CMDLINE_LINUX) and rebooting. Alternatively, boot a kernel built with CONFIG_SLAB_MERGE_DEFAULT=n.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
With cache merging enabled, a heap overflow can reach across object types, widening the blast radius of kernel exploits. Precautions: disabling merging (via slab_nomerge or a non-merging kernel) increases kernel memory usage modestly because caches are no longer consolidated, watch memory on tightly constrained systems. Both routes require a reboot; schedule a maintenance window and keep a fallback boot entry. Test the new boot line in a console-accessible window to avoid being locked out if the parameter is mistyped.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R17 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.