[PATCH 2/2] changed kernel.randomize_va_space value to 2

Shawn Wells shawn at redhat.com
Wed Jan 23 23:49:36 UTC 2013


On 1/18/13 8:16 AM, David Smith wrote:
> Signed-off-by: David Smith<dsmith at eclipse.ncsc.mil>
> ---
>   RHEL6/input/system/permissions/execution.xml |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/system/permissions/execution.xml
> index 59b103c..2e85c05 100644
> --- a/RHEL6/input/system/permissions/execution.xml
> +++ b/RHEL6/input/system/permissions/execution.xml
> @@ -136,8 +136,8 @@ address range.</rationale>
>   
>   <Rule id="enable_randomize_va_space" severity="medium">
>   <title>Enable Randomized Layout of Virtual Address Space</title>
> -<description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="1" /></description>
> -<ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="1" /></ocil>
> +<description><sysctl-desc-macro sysctl="kernel.randomize_va_space" value="2" /></description>
> +<ocil><sysctl-check-macro sysctl="kernel.randomize_va_space" value="2" /></ocil>
>   <rationale> Address space layout randomization (ASLR) makes it more difficult
>   for an attacker to predict the location of attack code he or she has introduced
>   into a process's address space during an attempt at exploitation.  Additionally, ASLR also

It was bugging me why we chose randomize_va_space=1 instead of 2. Turns 
out the USGCB for RHEL5 has it set to 1, so we must have just inherited 
it. Made a note that USGCB for RHEL6 should have this set as 2.


More information about the scap-security-guide mailing list