Disable Kernel Image Loading
Sets kernel.kexec_load_disabled = 1 so no new kernel image can be loaded at runtime via the kexec syscall.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Disabling kexec_load allows greater control of kernel memory. Once disabled, it becomes impossible to load another kernel image at runtime via kexec. This blocks an attacker who has gained root from booting a malicious or backdoored kernel in place of the running one without a full reboot, and also prevents bypassing Secure Boot through kexec.
What Pavois checks
Pavois reads the live kernel value with kernel_parameter('kernel.kexec_load_disabled') (equivalent to sysctl kernel.kexec_load_disabled), not the contents of /etc/sysctl.conf or /etc/sysctl.d/*.conf. This matters: a value written in a file is only effective after it has been applied, and a later drop-in, a boot-time override or a manual sysctl -w can change the running value. Reading the effective parameter is the only way to confirm what the kernel is actually enforcing right now. Note: kexec_load_disabled is a one-way latch, once set to 1, the kernel refuses to set it back to 0.
describe kernel_parameter('kernel.kexec_load_disabled') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*kernel.kexec_load_disabled[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl kernel.kexec_load_disabled (or cat /proc/sys/kernel/kexec_load_disabled). Expected output:
kernel.kexec_load_disabled = 1
Inspect & investigate
There is no dedicated log line for this knob. Confirm the runtime state with sysctl kernel.kexec_load_disabled. Any blocked attempt to load an image surfaces as a kexec_load syscall returning EPERM; if a kernel-load audit rule is configured, the denial is visible in /var/log/audit/audit.log.
Remediation
Pavois's harden plan uses the sysctl resource to set kernel.kexec_load_disabled = 1, persisting it in a Pavois-managed drop-in under /etc/sysctl.d/ and applying it live so no reboot is needed. Apply it with pavois harden apply. Because this is a one-way latch, it stays effective until the next reboot regardless of later changes.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | kernel.kexec_load_disabled |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a root-level attacker can load an arbitrary kernel via kexec, swapping the trusted kernel for a malicious one and bypassing Secure Boot, all without a visible reboot.
Precautions before applying:
- This disables
kexec-based fast reboots and crash-kernel handoff. If you rely onkdump/kexecfor crash dumps or fast reboots, this control will break that workflow, disable it on those hosts or accept slower full reboots. - The setting is a one-way latch: it cannot be reverted at runtime, only by a full reboot. Validate on a non-critical host first.