TMA-COS-1.4.3
Ensure address space layout randomization (ASLR) is enabled
MediumLevel 1Automatedcos
Description
Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process. Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.
How it is checked
Audit method: Shell command
shell
chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk kernel.randomize_va_space 2; then echo compliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set the following parameter in /etc/sysctl.conf or a /etc/sysctl.d/* file: kernel.randomize_va_space = 2 Run the following command to set the active kernel parameter: # sysctl -w kernel.randomize_va_space=2
Properties
- Operating systems
- Any
- Tags
- container-optimized-oscos
- Reference
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 1.4.3 Ensure address space layout randomization (ASLR) is enabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cos