Make the kernel text and rodata read-only
Requires the kernel to be built with CONFIG_STRICT_KERNEL_RWX=y, mapping kernel .text read-only and .rodata non-executable.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CONFIG_STRICT_KERNEL_RWX=y enforces strict W^X (write-xor-execute) on kernel memory: executable code (.text) is mapped read-only and non-writable, and read-only data (.rodata) is mapped non-executable. This blocks two cornerstone exploit techniques, patching kernel code in place to plant a rootkit, and executing data regions as code, forcing attackers to use far more constrained methods.
What Pavois checks
Pavois reads the build configuration of the running kernel via /boot/config-$(uname -r) or /proc/config.gz and confirms CONFIG_STRICT_KERNEL_RWX=y. Reading the booted kernel's effective config proves the memory protections are compiled into the kernel actually in use, not just an installed default.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_STRICT_KERNEL_RWX=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_STRICT_KERNEL_RWX=y$/) }
endHow to verify it is applied
grep '^CONFIG_STRICT_KERNEL_RWX=' /boot/config-$(uname -r) || zcat /proc/config.gz | grep '^CONFIG_STRICT_KERNEL_RWX='
Expected output: CONFIG_STRICT_KERNEL_RWX=y. The kernel also logs the mappings at boot, see below.
Inspect & investigate
At boot the kernel reports the protected mappings, inspect dmesg or journalctl -k for lines like Write protecting the kernel read-only data or rodata=on. A violation (write to read-only kernel memory) triggers an oops/panic also visible there.
Remediation
No automated remediation is shipped: CONFIG_STRICT_KERNEL_RWX is a compile-time kernel option and cannot be enabled at runtime. The fix is to boot a kernel built with it enabled, the stock distribution kernels for the supported OSes already do. For a custom kernel, set CONFIG_STRICT_KERNEL_RWX=y and rebuild; avoid disabling it via a rodata=off boot parameter.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without strict kernel RWX, kernel code and read-only data remain writable/executable, letting an attacker who gains a write primitive plant a persistent rootkit by patching kernel text. Precautions: the remedy is a kernel change requiring a reboot, schedule a maintenance window and keep a fallback boot entry. Some live kernel-patching, certain debuggers, and a few legacy out-of-tree modules may misbehave with W^X enforced; validate any such tooling. Performance overhead is negligible.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.