All,
Sorry I've been away for a while, things have been very busy here.
My system fails the ASLR sysctl test because is more secure than the test requires.
The test checks that the ASLR control is set to "1" while setting it to "2" randomizes more of the system's memory.
See Linux documentation file Documentation/sysctl/kernel.txt
http://lxr.linux.no/#linux+v3.7.2/Documentation/sysctl/kernel.txt#L482
Thanks,
Kenneth Stailey (1): Please Randomize Heap Space too
RHEL6/input/checks/templates/sysctl_values.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Setting kernel.randomize_va_space = 2 does what setting it to "1" does plus it enables heap randomization too. It is recommended by Red Hat, see https://access.redhat.com/knowledge/solutions/69124
Signed-off-by: Kenneth Stailey kstailey.lists@gmail.com --- RHEL6/input/checks/templates/sysctl_values.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv index 00d6b9a..787aa5c 100644 --- a/RHEL6/input/checks/templates/sysctl_values.csv +++ b/RHEL6/input/checks/templates/sysctl_values.csv @@ -1,5 +1,5 @@ kernel.exec-shield,1 -kernel.randomize_va_space,1 +kernel.randomize_va_space,2 net.ipv4.conf.all.accept_redirects,0 net.ipv4.conf.all.accept_source_route,0 net.ipv4.conf.all.log_martians,1
On 1/15/13 7:25 PM, Kenneth Stailey wrote:
All,
Sorry I've been away for a while, things have been very busy here.
My system fails the ASLR sysctl test because is more secure than the test requires.
The test checks that the ASLR control is set to "1" while setting it to "2" randomizes more of the system's memory.
See Linux documentation file Documentation/sysctl/kernel.txt
http://lxr.linux.no/#linux+v3.7.2/Documentation/sysctl/kernel.txt#L482
I went ahead and patched this behavior as a bugfix [1] until a decision can be made about permanently upping the ASLR value. The check now scans for >= 1 which will eliminate the false positive if users have a higher setting. Thank you for reporting this bug!
[1] https://fedorahosted.org/scap-security-guide/changeset/e7973bb192b23d1185e5c...
On Tuesday, January 15, 2013 08:26:37 PM Shawn Wells wrote:
On 1/15/13 7:25 PM, Kenneth Stailey wrote:
All,
Sorry I've been away for a while, things have been very busy here.
My system fails the ASLR sysctl test because is more secure than the test requires.
The test checks that the ASLR control is set to "1" while setting it to "2" randomizes more of the system's memory.
See Linux documentation file Documentation/sysctl/kernel.txt
http://lxr.linux.no/#linux+v3.7.2/Documentation/sysctl/kernel.txt#L482
I went ahead and patched this behavior as a bugfix [1] until a decision can be made about permanently upping the ASLR value. The check now scans for >= 1 which will eliminate the false positive if users have a higher setting. Thank you for reporting this bug!
2 is the default value in the kernel. Its also what we expect in USGCB for RHEL5. So, it should be left alone (2) instead of making people change it to a less secure value of 1.
-Steve
scap-security-guide@lists.fedorahosted.org