{ "generated_at": "2026-09-21T19:16:06+00:00", "freshness_window_days": 30, "states": [ "VERIFIED", "FAILED", "STALE", "INCOMPLETE", "CURATED", "UNKNOWN" ], "platforms": [ { "os": "debian12", "state": "VERIFIED", "reasons": [ "campaign golden-debian12-20260921-175531", "verdict PASSED", "corpus matches (sha256:2a0e683f2fe7152b...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-debian12-20260921-175531", "verdict": "PASSED", "ran_at": "2026-09-21T16:12:35+00:00", "age_days": 0, "transitions": { "fail>fail": 33, "fail>na": 1, "fail>pass": 210, "na>na": 78, "na>pass": 39, "pass>pass": 260 }, "regressed_controls": [] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:2a0e683f2fe7152b922105b2264b7a1ab711ef6839204e22d0dccbd4b490573a", "campaign_digest": "sha256:2a0e683f2fe7152b922105b2264b7a1ab711ef6839204e22d0dccbd4b490573a", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 180, "failed": 208, "total": 388, "grade": "E" }, { "class": "manual", "passed": 35, "failed": 4, "total": 39, "grade": "B" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 10, "total": 13, "grade": "C" }, { "class": "kernel-build", "passed": 39, "failed": 18, "total": 57, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 218, "remediable_total": 434 }, "passed": 260, "total": 504, "failing_by_severity": { "critical": 1, "high": 7, "low": 31, "medium": 205 }, "qualified_passes": 10, "runtime_qualified": true, "platform": "debian 12.15", "timestamp": "2026-09-21T15:59:32Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:5370734e7fa6c8f23bd6f5c6148aeee917f059f5eb4432df074cd755c3dc508e", "ruleset_digest": "sha256:2a0e683f2fe7152b922105b2264b7a1ab711ef6839204e22d0dccbd4b490573a", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-session-events", "audit-suid-auid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-space-left-action", "banner-issue", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "filegroupownerships-var-log-apt", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-sshd-config", "fileperm-systemmap", "fileperm-var-log-cloud-init", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "growth-logrotate-active", "grub-password", "home-files-permissions", "journald-compress", "journald-forwardtosyslog", "journald-storage", "kconfig-debug-credentials", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-modify-ldt-syscall", "kconfig-module-sig-all", "kconfig-module-sig-force", "kconfig-module-sig-sha512", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-jffs2-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "logging-present", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-pass_min_len", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-dev-shm-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-pwquality-enabled", "pam-remember-pwhistory-remember", "pam-remember-unix-remember", "pam-unix-authtok", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-apparmor-utils-installed", "pkg-apt-listbugs-installed", "pkg-apt-show-versions-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-cron-installed", "pkg-debsums-installed", "pkg-fail2ban-installed", "pkg-libpam-apparmor-installed", "pkg-libpam-tmpdir-installed", "pkg-logrotate-installed", "pkg-needrestart-installed", "pkg-pam-pwquality-installed", "pkg-postfix-installed", "pkg-sssd-installed", "pkg-systemd-journal-remote-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "service-auditd-enabled", "service-cron-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-disable-x11-forwarding", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sysctl-dev-tty-ldisc-autoload", "sysctl-fs-protected_fifos", "sysctl-fs-suid_dumpable", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-kptr_restrict", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-kernel-yama-ptrace_scope", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-accept_source_route", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "sysctl-vm-mmap_min_addr", "time-sync-present", "umask-etc-bashrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "D", "posture": { "classes": [ { "class": "auto", "passed": 424, "failed": 0, "total": 424, "grade": "A" }, { "class": "manual", "passed": 40, "failed": 1, "total": 41, "grade": "A" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 10, "total": 13, "grade": "C" }, { "class": "kernel-build", "passed": 39, "failed": 18, "total": 57, "grade": "C" } ], "remediable_grade": "C", "remediable_points": 55, "remediable_passed": 467, "remediable_total": 472 }, "passed": 509, "total": 542, "failing_by_severity": { "high": 2, "low": 12, "medium": 19 }, "qualified_passes": 22, "runtime_qualified": true, "platform": "debian 12.15", "timestamp": "2026-09-21T16:12:35Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:5370734e7fa6c8f23bd6f5c6148aeee917f059f5eb4432df074cd755c3dc508e", "ruleset_digest": "sha256:2a0e683f2fe7152b922105b2264b7a1ab711ef6839204e22d0dccbd4b490573a", "failing_controls": [ "grub-password", "kconfig-debug-credentials", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-modify-ldt-syscall", "kconfig-module-sig-all", "kconfig-module-sig-force", "kconfig-module-sig-sha512", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-overlayfs-disabled", "misc-sshd-limit-user-access", "mount-dev-shm-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "sudo-noexec", "sudo-requiretty" ] } }, { "os": "debian13", "state": "VERIFIED", "reasons": [ "campaign golden-debian13-20260921-181236", "verdict PASSED", "corpus matches (sha256:c55148f2100e860a...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-debian13-20260921-181236", "verdict": "PASSED", "ran_at": "2026-09-21T16:31:37+00:00", "age_days": 0, "transitions": { "fail>fail": 32, "fail>na": 1, "fail>pass": 212, "na>na": 75, "na>pass": 39, "pass>pass": 261 }, "regressed_controls": [] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:c55148f2100e860afb1364dee124715ed8cf4cc57c417ca70e07f5b6b1693509", "campaign_digest": "sha256:c55148f2100e860afb1364dee124715ed8cf4cc57c417ca70e07f5b6b1693509", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 178, "failed": 210, "total": 388, "grade": "E" }, { "class": "manual", "passed": 35, "failed": 4, "total": 39, "grade": "B" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 6, "failed": 10, "total": 16, "grade": "C" }, { "class": "kernel-build", "passed": 39, "failed": 17, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 216, "remediable_total": 434 }, "passed": 261, "total": 506, "failing_by_severity": { "critical": 1, "high": 7, "low": 29, "medium": 208 }, "qualified_passes": 10, "runtime_qualified": true, "platform": "debian 13.7", "timestamp": "2026-09-21T16:17:05Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:c55148f2100e860afb1364dee124715ed8cf4cc57c417ca70e07f5b6b1693509", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-session-events", "audit-suid-auid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-space-left-action", "banner-issue", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "filegroupowner-backup-etc-gshadow", "filegroupowner-backup-etc-shadow", "filegroupownerships-var-log-apt", "fileperm-backup-etc-gshadow", "fileperm-backup-etc-shadow", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-sshd-config", "fileperm-systemmap", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "growth-logrotate-active", "grub-password", "home-files-permissions", "journald-compress", "journald-forwardtosyslog", "journald-storage", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-modify-ldt-syscall", "kconfig-module-sig-all", "kconfig-module-sig-force", "kconfig-module-sig-sha512", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-jffs2-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "logging-present", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-pass_min_len", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-all-apparmor-profiles-enforced", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-dev-shm-noexec", "mount-tmp-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-pwquality-enabled", "pam-remember-pwhistory-remember", "pam-unix-authtok", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-apparmor-utils-installed", "pkg-apt-listbugs-installed", "pkg-apt-show-versions-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-cron-installed", "pkg-debsums-installed", "pkg-fail2ban-installed", "pkg-libpam-apparmor-installed", "pkg-libpam-tmpdir-installed", "pkg-logrotate-installed", "pkg-needrestart-installed", "pkg-pam-pwquality-installed", "pkg-postfix-installed", "pkg-sssd-installed", "pkg-systemd-journal-remote-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "service-auditd-enabled", "service-cron-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-enable-pam", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sysctl-dev-tty-ldisc-autoload", "sysctl-fs-protected_fifos", "sysctl-fs-suid_dumpable", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-kptr_restrict", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-kernel-yama-ptrace_scope", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "sysctl-vm-mmap_min_addr", "time-sync-present", "umask-etc-bashrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "D", "posture": { "classes": [ { "class": "auto", "passed": 424, "failed": 0, "total": 424, "grade": "A" }, { "class": "manual", "passed": 40, "failed": 1, "total": 41, "grade": "A" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 6, "failed": 10, "total": 16, "grade": "C" }, { "class": "kernel-build", "passed": 39, "failed": 17, "total": 56, "grade": "C" } ], "remediable_grade": "C", "remediable_points": 55, "remediable_passed": 467, "remediable_total": 472 }, "passed": 512, "total": 544, "failing_by_severity": { "high": 2, "low": 10, "medium": 20 }, "qualified_passes": 23, "runtime_qualified": true, "platform": "debian 13.7", "timestamp": "2026-09-21T16:31:37Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:c55148f2100e860afb1364dee124715ed8cf4cc57c417ca70e07f5b6b1693509", "failing_controls": [ "grub-password", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-modify-ldt-syscall", "kconfig-module-sig-all", "kconfig-module-sig-force", "kconfig-module-sig-sha512", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-overlayfs-disabled", "misc-sshd-limit-user-access", "mount-dev-shm-noexec", "mount-tmp-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "sudo-noexec", "sudo-requiretty" ] } }, { "os": "fedora", "state": "VERIFIED", "reasons": [ "campaign golden-fedora-20260921-185907", "verdict PASSED", "corpus matches (sha256:39bfc5bd63d7c75b...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-fedora-20260921-185907", "verdict": "PASSED", "ran_at": "2026-09-21T17:19:22+00:00", "age_days": 0, "transitions": { "fail>fail": 52, "fail>na": 1, "fail>pass": 234, "na>na": 83, "na>pass": 52, "pass>fail": 1, "pass>pass": 283 }, "regressed_controls": [ "findloop-file-groupownership-system-commands-dirs" ] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:39bfc5bd63d7c75bc9fa7536f059695c8f60ff645ec01589bb511b85995ba0d3", "campaign_digest": "sha256:39bfc5bd63d7c75bc9fa7536f059695c8f60ff645ec01589bb511b85995ba0d3", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 196, "failed": 251, "total": 447, "grade": "E" }, { "class": "manual", "passed": 37, "failed": 3, "total": 40, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 7, "total": 11, "grade": "C" }, { "class": "install-time", "passed": 6, "failed": 11, "total": 17, "grade": "C" }, { "class": "kernel-build", "passed": 41, "failed": 15, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 237, "remediable_total": 498 }, "passed": 284, "total": 571, "failing_by_severity": { "critical": 1, "high": 7, "low": 32, "medium": 247 }, "qualified_passes": 10, "runtime_qualified": true, "platform": "fedora 43", "timestamp": "2026-09-21T17:05:02Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:39bfc5bd63d7c75bc9fa7536f059695c8f60ff645ec01589bb511b85995ba0d3", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-etc", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-kernel-module-loading", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-networkconfig-modification-network-scripts", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-admin-space-left-percentage", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-flush", "auditd-freq", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-name-format", "auditd-num-logs", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-issue-net", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-init-on-alloc", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-nousb", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "fileperm-boot-grub2", "fileperm-systemmap", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "growth-logrotate-active", "home-files-permissions", "journald-compress", "journald-forwardtosyslog", "journald-storage", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-x86-vsyscall-emulation", "kmod-atm-disabled", "kmod-bluetooth-disabled", "kmod-can-disabled", "kmod-cfg80211-disabled", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-firewire-core-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-iwlmvm-disabled", "kmod-iwlwifi-disabled", "kmod-jffs2-disabled", "kmod-mac80211-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "kmod-uvcvideo-disabled", "logging-present", "logindefs-fail_delay", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-ensure-pam-wheel-group-empty", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "mount-tmp-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-remember-pwhistory-remember", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-audit-rules-installed", "pkg-cron-installed", "pkg-cryptsetup-luks-installed", "pkg-dnf-automatic-installed", "pkg-fapolicyd-installed", "pkg-firewalld-installed", "pkg-gnome-software-installed", "pkg-gnutls-utils-installed", "pkg-libreswan-installed", "pkg-logrotate-installed", "pkg-nss-tools-installed", "pkg-opensc-installed", "pkg-openscap-scanner-installed", "pkg-pcsc-lite-installed", "pkg-policycoreutils-python-utils-installed", "pkg-postfix-installed", "pkg-rear-installed", "pkg-rng-tools-installed", "pkg-s-nail-installed", "pkg-scap-security-guide-installed", "pkg-screen-installed", "pkg-sssd-installed", "pkg-subscription-manager-installed", "pkg-systemd-journal-remote-installed", "pkg-tmux-installed", "pkg-usbguard-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxclassrepeat", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "selinux-enforcing", "service-auditd-enabled", "service-crond-enabled", "service-fapolicyd-enabled", "service-rngd-enabled", "service-systemd-coredump-disabled", "service-usbguard-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-gssapi-auth", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-disable-x11-forwarding", "ssh-enable-warning-banner", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sudo-use-pty", "sysctl-fs-protected_fifos", "sysctl-fs-protected_regular", "sysctl-fs-suid_dumpable", "sysctl-kernel-core_pattern", "sysctl-kernel-core_uses_pid", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-kexec_load_disabled", "sysctl-kernel-kptr_restrict", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-kernel-yama-ptrace_scope", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-forwarding", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-forwarding", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-forwarding", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "sysctl-user-max_user_namespaces", "sysctl-vm-mmap_min_addr", "time-sync-present", "umask-etc-bashrc", "umask-etc-csh-cshrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 478, "failed": 18, "total": 496, "grade": "E" }, { "class": "manual", "passed": 40, "failed": 2, "total": 42, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 7, "total": 11, "grade": "C" }, { "class": "install-time", "passed": 6, "failed": 11, "total": 17, "grade": "C" }, { "class": "kernel-build", "passed": 41, "failed": 15, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 10, "remediable_passed": 522, "remediable_total": 549 }, "passed": 569, "total": 622, "failing_by_severity": { "high": 4, "low": 15, "medium": 34 }, "qualified_passes": 25, "runtime_qualified": true, "platform": "fedora 43", "timestamp": "2026-09-21T17:19:22Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:39bfc5bd63d7c75bc9fa7536f059695c8f60ff645ec01589bb511b85995ba0d3", "failing_controls": [ "audit-etc", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-init-on-alloc", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-nousb", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "findloop-file-groupownership-system-commands-dirs", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-x86-vsyscall-emulation", "kmod-firewire-core-disabled", "kmod-overlayfs-disabled", "misc-sshd-limit-user-access", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "mount-tmp-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-fapolicyd-installed", "selinux-enforcing", "service-fapolicyd-enabled", "sudo-noexec", "sudo-requiretty", "sysctl-user-max_user_namespaces" ] } }, { "os": "rhel10", "state": "VERIFIED", "reasons": [ "campaign golden-rhel10-20260921-185927", "verdict PASSED", "corpus matches (sha256:8954b5dbea426d21...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-rhel10-20260921-185927", "verdict": "PASSED", "ran_at": "2026-09-21T17:15:49+00:00", "age_days": 0, "transitions": { "fail>fail": 51, "fail>pass": 230, "na>fail": 2, "na>na": 80, "na>pass": 32, "pass>fail": 3, "pass>na": 2, "pass>pass": 287 }, "regressed_controls": [ "file-at-deny-absent", "misc-postfix-anti-vrfy", "misc-postfix-banner" ] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:8954b5dbea426d217c08630878c13f42ecef25c65f1d21fcf118993645de6721", "campaign_digest": "sha256:8954b5dbea426d217c08630878c13f42ecef25c65f1d21fcf118993645de6721", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 206, "failed": 247, "total": 453, "grade": "E" }, { "class": "manual", "passed": 36, "failed": 3, "total": 39, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 7, "total": 11, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 11, "total": 14, "grade": "C" }, { "class": "kernel-build", "passed": 43, "failed": 13, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 246, "remediable_total": 503 }, "passed": 292, "total": 573, "failing_by_severity": { "critical": 1, "high": 7, "low": 30, "medium": 243 }, "qualified_passes": 11, "runtime_qualified": true, "platform": "almalinux 10.2", "timestamp": "2026-09-21T17:05:16Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:8954b5dbea426d217c08630878c13f42ecef25c65f1d21fcf118993645de6721", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-kernel-module-loading", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-networkconfig-modification-network-scripts", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-admin-space-left-percentage", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-flush", "auditd-freq", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-name-format", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-issue-net", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-init-on-alloc", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-nousb", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "file-cron-deny-absent", "filegroupowner-var-log-secure", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-cron-hourly", "fileperm-cron-monthly", "fileperm-cron-weekly", "fileperm-crontab", "fileperm-sshd-config", "fileperm-systemmap", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "home-files-permissions", "journald-compress", "journald-storage", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-proc-kcore", "kconfig-x86-vsyscall-emulation", "kmod-atm-disabled", "kmod-bluetooth-disabled", "kmod-can-disabled", "kmod-cfg80211-disabled", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-firewire-core-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-iwlmvm-disabled", "kmod-iwlwifi-disabled", "kmod-jffs2-disabled", "kmod-mac80211-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "kmod-uvcvideo-disabled", "logindefs-fail_delay", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-ensure-pam-wheel-group-empty", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-remember-pwhistory-remember", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-audit-rules-installed", "pkg-cryptsetup-luks-installed", "pkg-dnf-automatic-installed", "pkg-fapolicyd-installed", "pkg-firewalld-installed", "pkg-gnutls-utils-installed", "pkg-libreswan-installed", "pkg-nss-tools-installed", "pkg-opensc-installed", "pkg-openscap-scanner-installed", "pkg-pcsc-lite-installed", "pkg-policycoreutils-python-utils-installed", "pkg-postfix-installed", "pkg-rear-installed", "pkg-s-nail-installed", "pkg-scap-security-guide-installed", "pkg-sssd-installed", "pkg-subscription-manager-installed", "pkg-systemd-journal-remote-installed", "pkg-tmux-installed", "pkg-usbguard-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxclassrepeat", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "selinux-enforcing", "service-auditd-enabled", "service-bluetooth-disabled", "service-fapolicyd-enabled", "service-systemd-coredump-disabled", "service-usbguard-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-enable-pam", "ssh-enable-warning-banner", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use-directory-configuration", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sudo-use-pty", "sysctl-fs-protected_fifos", "sysctl-fs-protected_regular", "sysctl-fs-suid_dumpable", "sysctl-kernel-core_pattern", "sysctl-kernel-core_uses_pid", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-kexec_load_disabled", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-kernel-yama-ptrace_scope", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-forwarding", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-forwarding", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-forwarding", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "sysctl-user-max_user_namespaces", "sysctl-vm-mmap_min_addr", "time-sync-present", "umask-etc-bashrc", "umask-etc-csh-cshrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 460, "failed": 23, "total": 483, "grade": "E" }, { "class": "manual", "passed": 39, "failed": 2, "total": 41, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 7, "total": 11, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 11, "total": 14, "grade": "C" }, { "class": "kernel-build", "passed": 43, "failed": 13, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 10, "remediable_passed": 503, "remediable_total": 535 }, "passed": 549, "total": 605, "failing_by_severity": { "high": 4, "low": 15, "medium": 37 }, "qualified_passes": 21, "runtime_qualified": true, "platform": "almalinux 10.2", "timestamp": "2026-09-21T17:15:49Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:8954b5dbea426d217c08630878c13f42ecef25c65f1d21fcf118993645de6721", "failing_controls": [ "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-init-on-alloc", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-nousb", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "file-at-deny-absent", "fileperm-at-deny", "fileperm-var-log-sssd", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-proc-kcore", "kconfig-x86-vsyscall-emulation", "kmod-firewire-core-disabled", "kmod-overlayfs-disabled", "misc-postfix-anti-vrfy", "misc-postfix-banner", "misc-sshd-limit-user-access", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-fapolicyd-installed", "selinux-enforcing", "service-fapolicyd-enabled", "sudo-noexec", "sudo-requiretty", "sysctl-user-max_user_namespaces" ] } }, { "os": "rhel8", "state": "VERIFIED", "reasons": [ "campaign golden-rhel8-20260921-191923", "verdict PASSED", "corpus matches (sha256:66b027690477c441...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-rhel8-20260921-191923", "verdict": "PASSED", "ran_at": "2026-09-21T17:35:16+00:00", "age_days": 0, "transitions": { "fail>fail": 61, "fail>pass": 219, "na>fail": 1, "na>na": 84, "na>pass": 24, "pass>fail": 3, "pass>pass": 292 }, "regressed_controls": [ "file-at-deny-absent", "misc-postfix-anti-vrfy", "misc-postfix-banner" ] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:66b027690477c44189a933379f8b1d83384fa71a781ce43e54f297af1d25dc1f", "campaign_digest": "sha256:66b027690477c44189a933379f8b1d83384fa71a781ce43e54f297af1d25dc1f", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 219, "failed": 236, "total": 455, "grade": "E" }, { "class": "manual", "passed": 36, "failed": 2, "total": 38, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 6, "total": 10, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 11, "total": 14, "grade": "C" }, { "class": "kernel-build", "passed": 33, "failed": 25, "total": 58, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 259, "remediable_total": 503 }, "passed": 295, "total": 575, "failing_by_severity": { "critical": 1, "high": 8, "low": 33, "medium": 238 }, "qualified_passes": 11, "runtime_qualified": true, "platform": "almalinux 8.10", "timestamp": "2026-09-21T17:24:20Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:66b027690477c44189a933379f8b1d83384fa71a781ce43e54f297af1d25dc1f", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-kernel-module-loading", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-networkconfig-modification-network-scripts", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-flush", "auditd-freq", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-name-format", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-issue-net", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "file-cron-deny-absent", "filegroupowner-var-log-secure", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-cron-hourly", "fileperm-cron-monthly", "fileperm-cron-weekly", "fileperm-crontab", "fileperm-sshd-config", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "home-files-permissions", "journald-compress", "journald-storage", "kconfig-debug-credentials", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-debug-wx", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-structleak", "kconfig-gcc-plugin-structleak-byref-all", "kconfig-hardened-usercopy-fallback", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-emulate", "kconfig-legacy-vsyscall-none", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-module-sig-sha512", "kconfig-page-poisoning-no-sanity", "kconfig-page-poisoning-zero", "kconfig-proc-kcore", "kconfig-refcount-full", "kconfig-sched-stack-end-check", "kconfig-security-dmesg-restrict", "kconfig-security-writable-hooks", "kconfig-x86-vsyscall-emulation", "kmod-atm-disabled", "kmod-bluetooth-disabled", "kmod-can-disabled", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-firewire-core-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-jffs2-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "kmod-uvcvideo-disabled", "logindefs-fail_delay", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-ensure-pam-wheel-group-empty", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-remember-pwhistory-remember", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-authselect-installed", "pkg-dnf-automatic-installed", "pkg-fapolicyd-installed", "pkg-firewalld-installed", "pkg-gnutls-utils-installed", "pkg-mailx-installed", "pkg-opensc-installed", "pkg-openscap-scanner-installed", "pkg-policycoreutils-python-utils-installed", "pkg-postfix-installed", "pkg-rear-installed", "pkg-rng-tools-installed", "pkg-scap-security-guide-installed", "pkg-sssd-installed", "pkg-subscription-manager-installed", "pkg-systemd-journal-remote-installed", "pkg-tmux-installed", "pkg-usbguard-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxclassrepeat", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "selinux-enforcing", "service-auditd-enabled", "service-bluetooth-disabled", "service-fapolicyd-enabled", "service-rngd-enabled", "service-systemd-coredump-disabled", "service-usbguard-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-enable-pam", "ssh-enable-warning-banner", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sudo-use-pty", "sysctl-fs-protected_fifos", "sysctl-fs-protected_regular", "sysctl-fs-suid_dumpable", "sysctl-kernel-core_pattern", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-kexec_load_disabled", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-kernel-yama-ptrace_scope", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-forwarding", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-accept_source_route", "sysctl-net-ipv4-conf-default-forwarding", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-forwarding", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "sysctl-user-max_user_namespaces", "sysctl-vm-mmap_min_addr", "time-sync-present", "umask-etc-bashrc", "umask-etc-csh-cshrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 456, "failed": 22, "total": 478, "grade": "E" }, { "class": "manual", "passed": 39, "failed": 1, "total": 40, "grade": "A" }, { "class": "dangerous", "passed": 4, "failed": 6, "total": 10, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 11, "total": 14, "grade": "C" }, { "class": "kernel-build", "passed": 33, "failed": 25, "total": 58, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 10, "remediable_passed": 499, "remediable_total": 528 }, "passed": 535, "total": 600, "failing_by_severity": { "high": 6, "low": 17, "medium": 42 }, "qualified_passes": 21, "runtime_qualified": true, "platform": "almalinux 8.10", "timestamp": "2026-09-21T17:35:16Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:66b027690477c44189a933379f8b1d83384fa71a781ce43e54f297af1d25dc1f", "failing_controls": [ "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "file-at-deny-absent", "fileperm-at-deny", "findloop-permissions-local-var-log", "firewall-default-deny", "kconfig-debug-credentials", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-debug-wx", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-structleak", "kconfig-gcc-plugin-structleak-byref-all", "kconfig-hardened-usercopy-fallback", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-emulate", "kconfig-legacy-vsyscall-none", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-module-sig-sha512", "kconfig-page-poisoning-no-sanity", "kconfig-page-poisoning-zero", "kconfig-proc-kcore", "kconfig-refcount-full", "kconfig-sched-stack-end-check", "kconfig-security-dmesg-restrict", "kconfig-security-writable-hooks", "kconfig-x86-vsyscall-emulation", "kmod-firewire-core-disabled", "kmod-overlayfs-disabled", "misc-postfix-anti-vrfy", "misc-postfix-banner", "misc-sshd-limit-user-access", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-fapolicyd-installed", "selinux-enforcing", "service-fapolicyd-enabled", "sudo-noexec", "sudo-requiretty", "sysctl-user-max_user_namespaces" ] } }, { "os": "rhel9", "state": "VERIFIED", "reasons": [ "campaign golden-rhel9-20260921-191550", "verdict PASSED", "corpus matches (sha256:eb672d807de00367...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-rhel9-20260921-191550", "verdict": "PASSED", "ran_at": "2026-09-21T17:30:53+00:00", "age_days": 0, "transitions": { "fail>fail": 42, "fail>pass": 246, "na>fail": 1, "na>na": 80, "na>pass": 33, "pass>fail": 3, "pass>na": 2, "pass>pass": 301 }, "regressed_controls": [ "file-at-deny-absent", "misc-postfix-anti-vrfy", "misc-postfix-banner" ] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:eb672d807de003677ab297dd37226324043bef1a323391eed510b504b2ff31b3", "campaign_digest": "sha256:eb672d807de003677ab297dd37226324043bef1a323391eed510b504b2ff31b3", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 224, "failed": 249, "total": 473, "grade": "E" }, { "class": "manual", "passed": 36, "failed": 3, "total": 39, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 7, "total": 11, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 11, "total": 14, "grade": "C" }, { "class": "kernel-build", "passed": 39, "failed": 18, "total": 57, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 264, "remediable_total": 523 }, "passed": 306, "total": 594, "failing_by_severity": { "critical": 1, "high": 7, "low": 33, "medium": 247 }, "qualified_passes": 11, "runtime_qualified": true, "platform": "almalinux 9.8", "timestamp": "2026-09-21T17:20:47Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:eb672d807de003677ab297dd37226324043bef1a323391eed510b504b2ff31b3", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-kernel-module-loading", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-networkconfig-modification-network-scripts", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-admin-space-left-percentage", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-flush", "auditd-freq", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-name-format", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-issue-net", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-init-on-alloc", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-nousb", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "cmdline-vsyscall", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "file-cron-deny-absent", "filegroupowner-var-log-secure", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-cron-hourly", "fileperm-cron-monthly", "fileperm-cron-weekly", "fileperm-crontab", "fileperm-sshd-config", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "home-files-permissions", "journald-compress", "journald-storage", "kconfig-debug-credentials", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-gcc-plugin-structleak", "kconfig-gcc-plugin-structleak-byref-all", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-proc-kcore", "kconfig-security-dmesg-restrict", "kconfig-x86-vsyscall-emulation", "kmod-atm-disabled", "kmod-bluetooth-disabled", "kmod-can-disabled", "kmod-cfg80211-disabled", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-firewire-core-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-iwlmvm-disabled", "kmod-iwlwifi-disabled", "kmod-jffs2-disabled", "kmod-mac80211-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "kmod-uvcvideo-disabled", "logindefs-fail_delay", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-ensure-pam-wheel-group-empty", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-remember-pwhistory-remember", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-authselect-installed", "pkg-cryptsetup-luks-installed", "pkg-dnf-automatic-installed", "pkg-fapolicyd-installed", "pkg-firewalld-installed", "pkg-gnutls-utils-installed", "pkg-libreswan-installed", "pkg-mailx-installed", "pkg-nss-tools-installed", "pkg-opensc-installed", "pkg-openscap-scanner-installed", "pkg-pcsc-lite-installed", "pkg-policycoreutils-python-utils-installed", "pkg-postfix-installed", "pkg-rear-installed", "pkg-rng-tools-installed", "pkg-s-nail-installed", "pkg-scap-security-guide-installed", "pkg-sssd-installed", "pkg-subscription-manager-installed", "pkg-systemd-journal-remote-installed", "pkg-tmux-installed", "pkg-usbguard-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxclassrepeat", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "selinux-enforcing", "service-auditd-enabled", "service-bluetooth-disabled", "service-fapolicyd-enabled", "service-rngd-enabled", "service-systemd-coredump-disabled", "service-usbguard-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-enable-pam", "ssh-enable-warning-banner", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use-directory-configuration", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sudo-use-pty", "sysctl-fs-protected_fifos", "sysctl-fs-protected_regular", "sysctl-fs-suid_dumpable", "sysctl-kernel-core_pattern", "sysctl-kernel-core_uses_pid", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-kexec_load_disabled", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-kernel-yama-ptrace_scope", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-forwarding", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-forwarding", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-forwarding", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "sysctl-user-max_user_namespaces", "sysctl-vm-mmap_min_addr", "time-sync-present", "umask-etc-bashrc", "umask-etc-csh-cshrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "D", "posture": { "classes": [ { "class": "auto", "passed": 495, "failed": 8, "total": 503, "grade": "C" }, { "class": "manual", "passed": 39, "failed": 2, "total": 41, "grade": "B" }, { "class": "dangerous", "passed": 4, "failed": 7, "total": 11, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 11, "total": 14, "grade": "C" }, { "class": "kernel-build", "passed": 39, "failed": 18, "total": 57, "grade": "C" } ], "remediable_grade": "D", "remediable_points": 44, "remediable_passed": 538, "remediable_total": 555 }, "passed": 580, "total": 626, "failing_by_severity": { "high": 2, "low": 13, "medium": 31 }, "qualified_passes": 22, "runtime_qualified": true, "platform": "almalinux 9.8", "timestamp": "2026-09-21T17:30:53Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:eb672d807de003677ab297dd37226324043bef1a323391eed510b504b2ff31b3", "failing_controls": [ "cmdline-nousb", "file-at-deny-absent", "fileperm-at-deny", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "kconfig-debug-credentials", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-gcc-plugin-structleak", "kconfig-gcc-plugin-structleak-byref-all", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-proc-kcore", "kconfig-security-dmesg-restrict", "kconfig-x86-vsyscall-emulation", "kmod-firewire-core-disabled", "kmod-overlayfs-disabled", "misc-postfix-anti-vrfy", "misc-postfix-banner", "misc-sshd-limit-user-access", "mount-boot-efi-nosuid", "mount-dev-shm-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-fapolicyd-installed", "pkg-mailx-installed", "selinux-enforcing", "service-fapolicyd-enabled", "sudo-noexec", "sudo-requiretty", "sysctl-user-max_user_namespaces" ] } }, { "os": "ubuntu2204", "state": "VERIFIED", "reasons": [ "campaign golden-ubuntu2204-20260921-183138", "verdict PASSED", "corpus matches (sha256:9b2c8f12d3651b7c...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-ubuntu2204-20260921-183138", "verdict": "PASSED", "ran_at": "2026-09-21T16:50:08+00:00", "age_days": 0, "transitions": { "fail>fail": 38, "fail>pass": 192, "na>na": 79, "na>pass": 23, "pass>pass": 273 }, "regressed_controls": [] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:9b2c8f12d3651b7cbaad9143ca1b8fcf9c1dece2edafd6c98526a216c5f2fc61", "campaign_digest": "sha256:9b2c8f12d3651b7cbaad9143ca1b8fcf9c1dece2edafd6c98526a216c5f2fc61", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 203, "failed": 187, "total": 390, "grade": "E" }, { "class": "manual", "passed": 31, "failed": 9, "total": 40, "grade": "B" }, { "class": "dangerous", "passed": 1, "failed": 3, "total": 4, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 9, "total": 12, "grade": "C" }, { "class": "kernel-build", "passed": 35, "failed": 22, "total": 57, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 235, "remediable_total": 434 }, "passed": 273, "total": 503, "failing_by_severity": { "critical": 1, "high": 5, "low": 30, "medium": 194 }, "qualified_passes": 9, "runtime_qualified": true, "platform": "ubuntu 22.04", "timestamp": "2026-09-21T16:35:38Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:9b2c8f12d3651b7cbaad9143ca1b8fcf9c1dece2edafd6c98526a216c5f2fc61", "failing_controls": [ "audit-dac-modification", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-privileged-commands-fdisk", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "audit-var-log-journal", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "filegroupownerships-var-log-apt", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-cron-hourly", "fileperm-cron-monthly", "fileperm-cron-weekly", "fileperm-crontab", "fileperm-grub2-cfg", "fileperm-journalctl", "fileperm-sshd-config", "fileperm-var-log", "findloop-file-groupownership-system-commands-dirs", "firewall-present", "growth-journal-bounded", "grub-password", "home-files-permissions", "journald-compress", "journald-storage", "kconfig-bug-on-data-corruption", "kconfig-debug-credentials", "kconfig-debug-list", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-gcc-plugin-structleak", "kconfig-gcc-plugin-structleak-byref-all", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-ptys", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-jffs2-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-pass_min_len", "misc-accounts-tmout", "misc-aide-build-database", "misc-all-apparmor-profiles-enforced", "misc-all-apparmor-profiles-in-enforce-complain-mode", "misc-apparmor-configured", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-dev-shm-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-pwquality-enabled", "pam-remember-pwhistory-remember", "pam-remember-unix-remember", "pam-unix-authtok", "pam-unix-rounds-password-auth", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-apparmor-installed", "pkg-apparmor-utils-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-nss-sss-installed", "pkg-opensc-installed", "pkg-pam-pwquality-installed", "pkg-pam-sss-installed", "pkg-postfix-installed", "pkg-sssd-installed", "pkg-systemd-journal-remote-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-lcredit", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "service-auditd-enabled", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-enable-pam", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-use-approved-ciphers-ordered", "ssh-use-approved-kex-ordered", "ssh-use-approved-macs-ordered", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-noexec", "sudo-requiretty", "sysctl-fs-protected_fifos", "sysctl-fs-suid_dumpable", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "umask-etc-bashrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "D", "posture": { "classes": [ { "class": "auto", "passed": 411, "failed": 0, "total": 411, "grade": "A" }, { "class": "manual", "passed": 38, "failed": 4, "total": 42, "grade": "B" }, { "class": "dangerous", "passed": 1, "failed": 3, "total": 4, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 9, "total": 12, "grade": "C" }, { "class": "kernel-build", "passed": 35, "failed": 22, "total": 57, "grade": "C" } ], "remediable_grade": "D", "remediable_points": 50, "remediable_passed": 450, "remediable_total": 457 }, "passed": 488, "total": 526, "failing_by_severity": { "high": 2, "low": 13, "medium": 23 }, "qualified_passes": 21, "runtime_qualified": true, "platform": "ubuntu 22.04", "timestamp": "2026-09-21T16:50:08Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:9b2c8f12d3651b7cbaad9143ca1b8fcf9c1dece2edafd6c98526a216c5f2fc61", "failing_controls": [ "grub-password", "kconfig-bug-on-data-corruption", "kconfig-debug-credentials", "kconfig-debug-list", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-gcc-plugin-structleak", "kconfig-gcc-plugin-structleak-byref-all", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-ptys", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "misc-sshd-limit-user-access", "mount-dev-shm-noexec", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "ssh-use-approved-ciphers-ordered", "ssh-use-approved-kex-ordered", "ssh-use-approved-macs-ordered", "sudo-noexec", "sudo-requiretty" ] } }, { "os": "ubuntu2404", "state": "VERIFIED", "reasons": [ "campaign golden-ubuntu2404-20260921-193517", "verdict PASSED", "corpus matches (sha256:c2d487cb65821e5a...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-ubuntu2404-20260921-193517", "verdict": "PASSED", "ran_at": "2026-09-21T17:55:27+00:00", "age_days": 0, "transitions": { "fail>fail": 35, "fail>pass": 216, "na>na": 86, "na>pass": 23, "pass>pass": 293 }, "regressed_controls": [] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:c2d487cb65821e5a0bd68cb7bc729e080e347c840ff1b7642c4902ad6f1a63db", "campaign_digest": "sha256:c2d487cb65821e5a0bd68cb7bc729e080e347c840ff1b7642c4902ad6f1a63db", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 217, "failed": 211, "total": 428, "grade": "E" }, { "class": "manual", "passed": 34, "failed": 6, "total": 40, "grade": "B" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 10, "total": 13, "grade": "C" }, { "class": "kernel-build", "passed": 36, "failed": 20, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 254, "remediable_total": 475 }, "passed": 293, "total": 544, "failing_by_severity": { "critical": 1, "high": 7, "low": 31, "medium": 212 }, "qualified_passes": 11, "runtime_qualified": true, "platform": "ubuntu 24.04", "timestamp": "2026-09-21T17:39:51Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:c2d487cb65821e5a0bd68cb7bc729e080e347c840ff1b7642c4902ad6f1a63db", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-privileged-commands-fdisk", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "audit-var-log-journal", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "filegroupownerships-var-log-apt", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-cron-hourly", "fileperm-cron-monthly", "fileperm-cron-weekly", "fileperm-crontab", "fileperm-journalctl", "fileperm-sshd-config", "fileperm-var-log", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "grub-password", "home-files-permissions", "journald-compress", "journald-storage", "kconfig-bug-on-data-corruption", "kconfig-debug-list", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-ptys", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-retpoline", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-jffs2-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-pass_min_len", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-all-apparmor-profiles-enforced", "misc-all-apparmor-profiles-in-enforce-complain-mode", "misc-apparmor-configured", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-dev-shm-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-pwquality-enabled", "pam-remember-pwhistory-remember", "pam-unix-authtok", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-apparmor-installed", "pkg-apparmor-utils-installed", "pkg-apt-show-versions-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-debsums-installed", "pkg-fail2ban-installed", "pkg-libpam-apparmor-installed", "pkg-libpam-tmpdir-installed", "pkg-needrestart-installed", "pkg-nss-sss-installed", "pkg-opensc-installed", "pkg-pam-pwquality-installed", "pkg-pam-sss-installed", "pkg-postfix-installed", "pkg-sssd-installed", "pkg-systemd-journal-remote-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "service-auditd-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-enable-pam", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use", "ssh-use-strong-ciphers", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sysctl-dev-tty-ldisc-autoload", "sysctl-fs-protected_fifos", "sysctl-fs-suid_dumpable", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-accept_source_route", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "umask-etc-bashrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "D", "posture": { "classes": [ { "class": "auto", "passed": 449, "failed": 0, "total": 449, "grade": "A" }, { "class": "manual", "passed": 41, "failed": 1, "total": 42, "grade": "A" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 3, "failed": 10, "total": 13, "grade": "C" }, { "class": "kernel-build", "passed": 36, "failed": 20, "total": 56, "grade": "C" } ], "remediable_grade": "C", "remediable_points": 55, "remediable_passed": 493, "remediable_total": 498 }, "passed": 532, "total": 567, "failing_by_severity": { "high": 2, "low": 13, "medium": 20 }, "qualified_passes": 24, "runtime_qualified": true, "platform": "ubuntu 24.04", "timestamp": "2026-09-21T17:55:27Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:c2d487cb65821e5a0bd68cb7bc729e080e347c840ff1b7642c4902ad6f1a63db", "failing_controls": [ "grub-password", "kconfig-bug-on-data-corruption", "kconfig-debug-list", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-ptys", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-retpoline", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-overlayfs-disabled", "misc-sshd-limit-user-access", "mount-dev-shm-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-tmp", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "sudo-noexec", "sudo-requiretty" ] } }, { "os": "ubuntu2604", "state": "VERIFIED", "reasons": [ "campaign golden-ubuntu2604-20260921-193054", "verdict PASSED", "corpus matches (sha256:7e1900796df95c7c...)", "0 day(s) old, within the 30-day window" ], "freshness_window_days": 30, "generated_at": "2026-09-21T19:16:06+00:00", "provenance": { "ran_on": "workstation", "run_url": null }, "campaign": { "id": "golden-ubuntu2604-20260921-193054", "verdict": "PASSED", "ran_at": "2026-09-21T17:50:18+00:00", "age_days": 0, "transitions": { "fail>fail": 36, "fail>pass": 215, "na>na": 83, "na>pass": 23, "pass>pass": 296 }, "regressed_controls": [] }, "evidence": { "source": "pavois-evidence-bundle/v1", "bundle_intact": true }, "corpus": { "current_digest": "sha256:7e1900796df95c7c13d17983afcfaa38ce98f4e407686332ff11270cd9d1a86c", "campaign_digest": "sha256:7e1900796df95c7c13d17983afcfaa38ce98f4e407686332ff11270cd9d1a86c", "matches": true }, "before": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 217, "failed": 211, "total": 428, "grade": "E" }, { "class": "manual", "passed": 34, "failed": 6, "total": 40, "grade": "B" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 6, "failed": 10, "total": 16, "grade": "C" }, { "class": "kernel-build", "passed": 36, "failed": 20, "total": 56, "grade": "C" } ], "remediable_grade": "E", "remediable_points": 0, "remediable_passed": 254, "remediable_total": 475 }, "passed": 296, "total": 547, "failing_by_severity": { "critical": 1, "high": 8, "low": 30, "medium": 212 }, "qualified_passes": 12, "runtime_qualified": true, "platform": "ubuntu 26.04", "timestamp": "2026-09-21T17:35:26Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:7e1900796df95c7c13d17983afcfaa38ce98f4e407686332ff11270cd9d1a86c", "failing_controls": [ "account-disable-inactive-pw", "audit-dac-modification", "audit-etc-cron-d", "audit-execution-chacl", "audit-file-deletion-events", "audit-immutable", "audit-login-events", "audit-mac-modification", "audit-media-export", "audit-networkconfig-modification", "audit-privileged-commands-fdisk", "audit-session-events", "audit-suid-auid-privilege-function", "audit-suid-privilege-function", "audit-sysadmin-actions", "audit-time", "audit-time-clock-settime", "audit-unsuccessful-file-modification", "audit-usergroup-modification", "audit-var-log-journal", "auditd-action-mail-acct", "auditd-admin-space-left-action", "auditd-disk-error-action", "auditd-disk-full-action", "auditd-max-log-file", "auditd-max-log-file-action", "auditd-space-left-action", "auditd-space-left-percentage", "banner-issue", "banner-motd", "cmdline-audit", "cmdline-audit-backlog-limit", "cmdline-l1tf", "cmdline-mce", "cmdline-mds", "cmdline-page-alloc-shuffle", "cmdline-page-poison", "cmdline-pti", "cmdline-rng-core-default-quality", "cmdline-slab-nomerge", "cmdline-slub-debug", "cmdline-spec-store-bypass-disable", "cmdline-spectre-v2", "faillock-deny", "faillock-unlock_time", "file-at-allow-exists", "file-cron-allow-exists", "filegroupownerships-var-log-apt", "fileperm-cron-d", "fileperm-cron-daily", "fileperm-cron-hourly", "fileperm-cron-monthly", "fileperm-cron-weekly", "fileperm-crontab", "fileperm-journalctl", "fileperm-sshd-config", "fileperm-var-log", "findloop-file-groupownership-system-commands-dirs", "findloop-permissions-local-var-log", "firewall-default-deny", "firewall-present", "growth-journal-bounded", "grub-password", "home-files-permissions", "journald-compress", "journald-storage", "kconfig-bug-on-data-corruption", "kconfig-debug-list", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-page-table-isolation", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-retpoline", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-cramfs-disabled", "kmod-dccp-disabled", "kmod-freevxfs-disabled", "kmod-hfs-disabled", "kmod-hfsplus-disabled", "kmod-jffs2-disabled", "kmod-overlayfs-disabled", "kmod-rds-disabled", "kmod-sctp-disabled", "kmod-squashfs-disabled", "kmod-tipc-disabled", "kmod-udf-disabled", "kmod-usb-storage-disabled", "logindefs-pass_max_days", "logindefs-pass_min_days", "logindefs-pass_min_len", "logindefs-sha-crypt-rounds", "misc-accounts-tmout", "misc-aide-build-database", "misc-aide-periodic-checking-systemd-timer", "misc-all-apparmor-profiles-enforced", "misc-all-apparmor-profiles-in-enforce-complain-mode", "misc-apparmor-configured", "misc-sshd-limit-user-access", "misc-use-pam-wheel-group-for-su", "mount-dev-shm-noexec", "mount-tmp-noexec", "pam-faillock-audit", "pam-faillock-deny-root", "pam-faillock-enabled", "pam-faillock-root-unlock-time", "pam-pwhistory-enabled", "pam-pwhistory-enforce", "pam-pwhistory-use-authtok", "pam-pwquality-enabled", "pam-remember-pwhistory-remember", "pam-unix-authtok", "pam-unix-no-nullok", "pam-unix-rounds-password-auth", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "pkg-aide-installed", "pkg-apparmor-installed", "pkg-apparmor-utils-installed", "pkg-apt-show-versions-installed", "pkg-audispd-plugins-installed", "pkg-audit-installed", "pkg-debsums-installed", "pkg-fail2ban-installed", "pkg-libpam-apparmor-installed", "pkg-libpam-tmpdir-installed", "pkg-needrestart-installed", "pkg-nss-sss-installed", "pkg-opensc-installed", "pkg-pam-pwquality-installed", "pkg-pam-sss-installed", "pkg-postfix-installed", "pkg-sssd-installed", "pkg-systemd-journal-remote-installed", "posture-core-dumps-limits", "posture-file-integrity", "posture-malware-scanner", "posture-process-accounting", "posture-sysstat", "pwquality-dcredit", "pwquality-dictcheck", "pwquality-difok", "pwquality-enforce-root", "pwquality-lcredit", "pwquality-maxrepeat", "pwquality-maxsequence", "pwquality-minclass", "pwquality-minlen", "pwquality-ocredit", "pwquality-retry", "pwquality-ucredit", "service-auditd-enabled", "ssh-disable-agent-forwarding", "ssh-disable-compression", "ssh-disable-forwarding", "ssh-disable-root-login", "ssh-disable-tcp-forwarding", "ssh-disable-tcpkeepalive", "ssh-disable-user-known-hosts", "ssh-enable-pam", "ssh-enable-warning-banner-net", "ssh-set-idle-timeout", "ssh-set-login-grace-time", "ssh-set-loglevel-verbose", "ssh-set-max-auth-tries", "ssh-set-maxstartups", "ssh-set-rekey-limit", "ssh-use", "ssh-use-strong-ciphers", "ssh-use-strong-kex", "ssh-use-strong-macs", "sudo-custom-logfile", "sudo-ignore-dot", "sudo-noexec", "sudo-requiretty", "sudo-umask", "sysctl-dev-tty-ldisc-autoload", "sysctl-fs-protected_fifos", "sysctl-fs-suid_dumpable", "sysctl-kernel-dmesg_restrict", "sysctl-kernel-panic_on_oops", "sysctl-kernel-perf_cpu_time_max_percent", "sysctl-kernel-perf_event_max_sample_rate", "sysctl-kernel-perf_event_paranoid", "sysctl-kernel-randomize_va_space", "sysctl-kernel-sysrq", "sysctl-kernel-unprivileged_bpf_disabled", "sysctl-net-core-bpf_jit_harden", "sysctl-net-ipv4-conf-all-accept_local", "sysctl-net-ipv4-conf-all-accept_redirects", "sysctl-net-ipv4-conf-all-accept_source_route", "sysctl-net-ipv4-conf-all-arp_filter", "sysctl-net-ipv4-conf-all-arp_ignore", "sysctl-net-ipv4-conf-all-drop_gratuitous_arp", "sysctl-net-ipv4-conf-all-log_martians", "sysctl-net-ipv4-conf-all-route_localnet", "sysctl-net-ipv4-conf-all-rp_filter", "sysctl-net-ipv4-conf-all-secure_redirects", "sysctl-net-ipv4-conf-all-send_redirects", "sysctl-net-ipv4-conf-all-shared_media", "sysctl-net-ipv4-conf-default-accept_redirects", "sysctl-net-ipv4-conf-default-log_martians", "sysctl-net-ipv4-conf-default-rp_filter", "sysctl-net-ipv4-conf-default-secure_redirects", "sysctl-net-ipv4-conf-default-send_redirects", "sysctl-net-ipv4-conf-default-shared_media", "sysctl-net-ipv4-icmp_echo_ignore_broadcasts", "sysctl-net-ipv4-icmp_ignore_bogus_error_responses", "sysctl-net-ipv4-ip_forward", "sysctl-net-ipv4-ip_local_port_range", "sysctl-net-ipv4-tcp_rfc1337", "sysctl-net-ipv4-tcp_syncookies", "sysctl-net-ipv6-conf-all-accept_ra", "sysctl-net-ipv6-conf-all-accept_ra_defrtr", "sysctl-net-ipv6-conf-all-accept_ra_pinfo", "sysctl-net-ipv6-conf-all-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-all-accept_redirects", "sysctl-net-ipv6-conf-all-accept_source_route", "sysctl-net-ipv6-conf-all-autoconf", "sysctl-net-ipv6-conf-all-forwarding", "sysctl-net-ipv6-conf-all-max_addresses", "sysctl-net-ipv6-conf-all-router_solicitations", "sysctl-net-ipv6-conf-default-accept_ra", "sysctl-net-ipv6-conf-default-accept_ra_defrtr", "sysctl-net-ipv6-conf-default-accept_ra_pinfo", "sysctl-net-ipv6-conf-default-accept_ra_rtr_pref", "sysctl-net-ipv6-conf-default-accept_redirects", "sysctl-net-ipv6-conf-default-accept_source_route", "sysctl-net-ipv6-conf-default-autoconf", "sysctl-net-ipv6-conf-default-max_addresses", "sysctl-net-ipv6-conf-default-router_solicitations", "umask-etc-bashrc", "umask-etc-login-defs", "umask-etc-profile" ] }, "after": { "grade": "E", "posture": { "classes": [ { "class": "auto", "passed": 448, "failed": 1, "total": 449, "grade": "A" }, { "class": "manual", "passed": 41, "failed": 1, "total": 42, "grade": "A" }, { "class": "dangerous", "passed": 3, "failed": 4, "total": 7, "grade": "C" }, { "class": "install-time", "passed": 6, "failed": 10, "total": 16, "grade": "C" }, { "class": "kernel-build", "passed": 36, "failed": 20, "total": 56, "grade": "C" } ], "remediable_grade": "C", "remediable_points": 52, "remediable_passed": 492, "remediable_total": 498 }, "passed": 534, "total": 570, "failing_by_severity": { "high": 3, "low": 13, "medium": 20 }, "qualified_passes": 25, "runtime_qualified": true, "platform": "ubuntu 26.04", "timestamp": "2026-09-21T17:50:18Z", "standards": [ "bp28", "cis", "pci-dss", "nist", "stig" ], "pavois_version": "dev", "pavois_digest": "sha256:9e51c628281cc4e4cae7f14fbc4e4745b63f8690e45cb5483649655db14b4837", "ruleset_digest": "sha256:7e1900796df95c7c13d17983afcfaa38ce98f4e407686332ff11270cd9d1a86c", "failing_controls": [ "grub-password", "kconfig-bug-on-data-corruption", "kconfig-debug-list", "kconfig-debug-notifiers", "kconfig-debug-sg", "kconfig-gcc-plugin-latent-entropy", "kconfig-gcc-plugin-randstruct", "kconfig-gcc-plugin-stackleak", "kconfig-hibernation", "kconfig-ia32-emulation", "kconfig-kexec", "kconfig-legacy-vsyscall-none", "kconfig-legacy-vsyscall-xonly", "kconfig-modify-ldt-syscall", "kconfig-module-sig-force", "kconfig-page-table-isolation", "kconfig-panic-on-oops", "kconfig-proc-kcore", "kconfig-retpoline", "kconfig-slab-merge-default", "kconfig-x86-vsyscall-emulation", "kmod-overlayfs-disabled", "misc-sshd-limit-user-access", "mount-dev-shm-noexec", "mount-tmp-noexec", "partition-boot", "partition-home", "partition-opt", "partition-srv", "partition-var", "partition-var-log", "partition-var-log-audit", "partition-var-tmp", "sudo-custom-logfile", "sudo-noexec", "sudo-requiretty" ] } } ] }