Prevent applications from mapping low portion of virtual memory
Reserves the low 64 KiB of virtual memory so processes cannot mmap near address 0, by setting vm.mmap_min_addr=65536.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The vm.mmap_min_addr parameter specifies the minimum virtual address a process is allowed to mmap. Leaving the low end of virtual memory mappable lets an attacker place controlled data at address 0, turning otherwise harmless kernel NULL-pointer dereference bugs into reliable, exploitable privilege escalations. Reserving the first 64 KiB (65536) removes that mapping window and neutralizes a whole class of NULL-deref exploits.
What Pavois checks
Pavois reads the live kernel value through kernel_parameter('vm.mmap_min_addr') (equivalent to sysctl vm.mmap_min_addr), not a .conf file. This is decisive: the runtime value is the merge of /etc/sysctl.conf, every /etc/sysctl.d/*.conf and /run/sysctl.d/*.conf drop-in, plus any in-flight override applied by sysctl -w. A file-based scanner can be fooled by a later drop-in or a manual override; reading the effective parameter cannot.
describe kernel_parameter('vm.mmap_min_addr') do
its('value') { should cmp 65536 }
end
describe command("grep -hsE '^[[:space:]]*vm.mmap_min_addr[[:space:]]*=[[:space:]]*65536([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl vm.mmap_min_addr. Expected output:
vm.mmap_min_addr = 65536
Inspect & investigate
There is no event log for a tunable; inspect its current state directly with sysctl vm.mmap_min_addr. To trace where the value comes from, use sysctl --system 2>&1 (it prints each drop-in as it is applied) or grep the sources with grep -r mmap_min_addr /etc/sysctl.conf /etc/sysctl.d/ /run/sysctl.d/.
Remediation
Pavois's harden plan uses the sysctl resource to set vm.mmap_min_addr to 65536. Running pavois harden apply writes the key to a Pavois-managed drop-in and applies it live (no reboot needed), so the effective value matches immediately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | vm.mmap_min_addr |
|---|---|
| resource | sysctl |
| value | 65536 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Very low risk on general-purpose servers: 65536 is the modern distribution default and reserving the low address space is transparent to normal applications. The rare exceptions are programs that legitimately map page 0 - notably 16-bit DOSEMU/dosbox, Wine in some modes, or QEMU/KVM with certain guest setups - which need a lower value. Before applying broadly, confirm none of these workloads run on the host; if they do, grant the specific capability or relax the value only on that host rather than disabling the rule fleet-wide.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.