[PATCH 2/2] changed kernel.randomize_va_space value to 2
Shawn Wells
shawn at redhat.com
Wed Jan 23 23:49:36 UTC 2013
On 1/18/13 8:16 AM, David Smith wrote:
> Signed-off-by: David Smith<dsmith at eclipse.ncsc.mil>
> ---
> RHEL6/input/system/permissions/execution.xml | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
> index 59b103c..2e85c05 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -136,8 +136,8 @@ address range.</rationale>
>
> <Rule id="enable_randomize_va_space" severity="medium">
> <title>Enable Randomized Layout of Virtual Address Space</title>
> -<description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="1" /></description>
> -<ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="1" /></ocil>
> +<description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="2" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="2" /></ocil>
> <rationale> Address space layout randomization (ASLR) makes it more difficult
> for an attacker to predict the location of attack code he or she has introduced
> into a process's address space during an attempt at exploitation. Additionally, ASLR also
It was bugging me why we chose randomize_va_space=1 instead of 2. Turns
out the USGCB for RHEL5 has it set to 1, so we must have just inherited
it. Made a note that USGCB for RHEL6 should have this set as 2.
More information about the scap-security-guide
mailing list