Ensure address space layout randomization (ASLR) is enabled

SedangLevel 1Otomatisbottlerocket

Deskripsi

Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process. The audit reads /proc/sys/kernel/randomize_va_space and requires 2. Run tmaegis on the host through the admin container root shell (sudo sheltie).

Cara pemeriksaan

Metode audit: Perintah shell

shell

bad=0
chk() { f=/proc/sys/$(printf %s "$1" | tr . /); v=$(cat "$f" 2>/dev/null) || { echo "$1: not readable"; bad=1; return; }; [ "$v" = "$2" ] || { echo "$1 = $v (expected $2)"; bad=1; }; }
chk kernel.randomize_va_space 2
[ "$bad" -eq 0 ] && echo compliant

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to set the active kernel parameter and persist the setting: # apiclient apply <<EOF [settings.kernel.sysctl] "kernel.randomize_va_space" = "2" EOF

Properti

Sistem operasi: Apa saja
Tag: bottlerocketsystem
Referensi: CIS Bottlerocket Benchmark v1.0.0 - 1.4.2 Ensure address space layout randomization (ASLR) is enabled

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target bottlerocket