[PATCH] Increase ASLR Level

Steve Grubb sgrubb at redhat.com
Wed Jan 16 14:04:08 UTC 2013


On Tuesday, January 15, 2013 08:26:37 PM Shawn Wells wrote:
> On 1/15/13 7:25 PM, Kenneth Stailey wrote:
> > All,
> > 
> > Sorry I've been away for a while, things have been very busy here.
> > 
> > My system fails the ASLR sysctl test because is more secure than the test
> > requires.
> > 
> > The test checks that the ASLR control is set to "1" while setting it to
> > "2"
> > randomizes more of the system's memory.
> > 
> > See Linux documentation file Documentation/sysctl/kernel.txt
> > 
> > http://lxr.linux.no/#linux+v3.7.2/Documentation/sysctl/kernel.txt#L482
> 
> I went ahead and patched this behavior as a bugfix [1] until a decision
> can be made about permanently upping the ASLR value. The check now scans
> for >= 1 which will eliminate the false positive if users have a higher
> setting. Thank you for reporting this bug!

2 is the default value in the kernel. Its also what we expect in USGCB for 
RHEL5. So, it should be left alone (2) instead of making people change it to a 
less secure value of 1.

-Steve


More information about the scap-security-guide mailing list