Disable x86 vsyscall emulation
Requires the kernel to be built without CONFIG_X86_VSYSCALL_EMULATION=y, removing the fixed-address legacy vsyscall page that offers ROP gadgets.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The legacy vsyscall page sits at a fixed address in every process and is obsolete (replaced by the randomized vDSO). Leaving CONFIG_X86_VSYSCALL_EMULATION=y keeps an executable region at a predictable location that supplies reliable ROP/JOP gadgets, undermining ASLR and easing exploitation. Disabling it removes that fixed attack primitive.
What Pavois checks
Pavois reads the running kernel's build config (/boot/config-$(uname -r) or /proc/config.gz) and asserts the option is not set to y. Inspecting the live kernel rather than a possibly-stale config file ensures the result matches the kernel that is actually executing.
describe command("C=/boot/config-$(uname -r); if [ -r \"$C\" ]; then cat \"$C\"; elif zcat /proc/config.gz 2>/dev/null | head -1 | grep -q .; then zcat /proc/config.gz; else echo PAVOIS_NO_KERNEL_CONFIG; fi | grep -E '^(CONFIG_X86_VSYSCALL_EMULATION=|PAVOIS_NO_KERNEL_CONFIG)'") do
its('stdout') { should_not match(/PAVOIS_NO_KERNEL_CONFIG/) }
its('stdout') { should_not match(/^CONFIG_X86_VSYSCALL_EMULATION=y$/) }
endHow to verify it is applied
Run grep '^CONFIG_X86_VSYSCALL_EMULATION=' /boot/config-$(uname -r). Expected: either no output, or CONFIG_X86_VSYSCALL_EMULATION=n / # CONFIG_X86_VSYSCALL_EMULATION is not set. The line CONFIG_X86_VSYSCALL_EMULATION=y is a failure. At runtime, the kernel parameter vsyscall=none achieves the same effect, check cat /proc/cmdline.
Inspect & investigate
No audit log applies to a build option. To see the effective runtime state, inspect the boot command line: cat /proc/cmdline (look for vsyscall=none) and dmesg | grep -i vsyscall.
Remediation
No automated remediation: remediation is empty because this is a kernel build-time choice. When the kernel is compiled with emulation, you can neutralize it at runtime by adding vsyscall=none to the boot command line (a manual GRUB change), or by booting a kernel built without the option. Apply manually, then re-scan.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| resource | kernel_build |
|---|
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Failing keeps a predictable executable page that aids ROP-based exploits. Precautions: very old static binaries (glibc < 2.14, ~2011) issue raw vsyscalls and may crash with SIGSEGV if vsyscall is fully disabled. On a system that might run such legacy software, prefer vsyscall=emulate only if necessary, otherwise validate that no application breaks before setting vsyscall=none or removing the option; keep a rollback boot entry.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R15 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.