User a virtually-mapped stack
Requires the kernel to be built with CONFIG_VMAP_STACK=y so kernel stacks have guard pages that catch overflows immediately.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CONFIG_VMAP_STACK=y allocates kernel thread stacks in vmalloc space, each fenced by an unmapped guard page. A stack overflow then faults immediately instead of silently corrupting adjacent kernel memory. Without it, kernel stack overflows produce hard-to-diagnose memory corruption that attackers can leverage for privilege escalation, and that masks the root cause of crashes.
What Pavois checks
Pavois reads the build-time config of the running kernel (/boot/config-$(uname -r) or /proc/config.gz) and requires CONFIG_VMAP_STACK=y. Querying the live kernel, not a static config file that may belong to another kernel package, guarantees the assertion describes the kernel actually executing.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_VMAP_STACK=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should match(/^CONFIG_VMAP_STACK=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_VMAP_STACK=' /boot/config-$(uname -r) (or zcat /proc/config.gz | grep CONFIG_VMAP_STACK). Expected output: CONFIG_VMAP_STACK=y.
Inspect & investigate
Build-time options leave no audit trail. If a guarded stack overflow occurs, the kernel logs it: check dmesg / journalctl -k for kernel stack overflow traces.
Remediation
No automated remediation: remediation is empty because CONFIG_VMAP_STACK is fixed at kernel compile time. Current distribution kernels (Debian, Ubuntu, RHEL/Alma on x86-64 and arm64) already ship with it enabled; if the check fails, install/boot a compliant vendor kernel manually and re-scan.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Failing means kernel stack overflows can silently corrupt memory rather than faulting cleanly, weakening exploit resistance and crash diagnosability. Precautions: changing kernels is the only remedy, keep the prior kernel bootable for rollback and validate that out-of-tree modules still load. The guard-page mechanism itself has negligible runtime cost.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.