Ensure address space layout randomization (ASLR) is enabled

MediaNivel 1Automatizadabottlerocket

Descripción

Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process. The audit reads /proc/sys/kernel/randomize_va_space and requires 2. Run tmaegis on the host through the admin container root shell (sudo sheltie).

Cómo se verifica

Método de auditoría: Comando de shell

shell

bad=0
chk() { f=/proc/sys/$(printf %s "$1" | tr . /); v=$(cat "$f" 2>/dev/null) || { echo "$1: not readable"; bad=1; return; }; [ "$v" = "$2" ] || { echo "$1 = $v (expected $2)"; bad=1; }; }
chk kernel.randomize_va_space 2
[ "$bad" -eq 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to set the active kernel parameter and persist the setting: # apiclient apply <<EOF [settings.kernel.sysctl] "kernel.randomize_va_space" = "2" EOF

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: bottlerocketsystem
Referencia: CIS Bottlerocket Benchmark v1.0.0 - 1.4.2 Ensure address space layout randomization (ASLR) is enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target bottlerocket