Ensure address space layout randomization (ASLR) is enabled

SrednjaNivo 1Automatskaros

Opis

Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process. The audit requires the running value and the persisted sysctl setting to be 2. Host-level control from the CIS ROS Melodic benchmark (Ubuntu 18.04 robot hosts); run as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

bad=0
chk() { case $1 in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0 ;; esac
  v=$(sysctl -n "$1" 2>/dev/null) || { echo "$1: not readable"; bad=1; return; }
  [ "$v" = "$2" ] || { echo "$1 = $v (expected $2)"; bad=1; }
  p=$(awk -F= -v k="$1" '{gsub(/^[ \t]+|[ \t]+$/, "", $1)} $1 == k {v = $2} END {gsub(/[ \t]/, "", v); print v}' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf 2>/dev/null)
  [ "$p" = "$2" ] || { echo "$1 not persisted as $2 in sysctl configuration (${p:-unset})"; bad=1; }; }
chk kernel.randomize_va_space 2
[ "$bad" -eq 0 ] && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set the following parameter in /etc/sysctl.conf or a /etc/sysctl.d/* file: kernel.randomize_va_space = 2 Run the following command to set the active kernel parameter: # sysctl -w kernel.randomize_va_space=2

Svojstva

Operativni sistemi: Bilo koji
Oznake: rosros1melodicsystem
Referenca: CIS ROS Melodic Benchmark v1.0.0 - 1.6.2 Ensure address space layout randomization (ASLR) is enabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target ros