Address space layout randomization (ASLR) maximized
Ensures the kernel runs with full ASLR by enforcing kernel.randomize_va_space = 2.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Address Space Layout Randomization (ASLR) randomizes the memory positions of the stack, heap, shared libraries and (with value 2) the data segments and brk-managed memory of every process. This makes memory-corruption exploits (buffer overflows, return-to-libc, ROP) far harder, because an attacker can no longer rely on predictable addresses. A value of 0 disables ASLR entirely and 1 only partially randomizes; only 2 provides full randomization, so anything less leaves the system substantially easier to exploit.
What Pavois checks
Pavois reads the effective, running kernel value via sysctl -n kernel.randomize_va_space and asserts it equals 2. Querying the live sysctl rather than /etc/sysctl.conf (or a drop-in under /etc/sysctl.d/) is what catches the real state: a config file may say 2 while a later drop-in, a boot parameter, or a runtime sysctl -w overrode it, only the resolved value tells the truth.
describe file('/proc/sys/kernel/randomize_va_space') do
its('content.strip') { should eq '2' }
endHow to verify it is applied
Run sysctl kernel.randomize_va_space. Expected output: kernel.randomize_va_space = 2. Reading /proc/sys/kernel/randomize_va_space should likewise print 2.
Inspect & investigate
- Current value:
sysctl kernel.randomize_va_spaceorcat /proc/sys/kernel/randomize_va_space. - Where it is set persistently:
grep -r randomize_va_space /etc/sysctl.conf /etc/sysctl.d/. - Boot-time application of sysctl settings is visible in
journalctl -u systemd-sysctl.
Remediation
Pavois's harden plan declares a sysctl resource setting kernel.randomize_va_space = 2, so pavois harden apply both applies it live (equivalent to sysctl -w kernel.randomize_va_space=2) and persists it in a drop-in so it survives reboots. No reboot is required for the new value to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | kernel.randomize_va_space |
|---|---|
| resource | sysctl |
| value | 2 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If ASLR is disabled or partial, memory-corruption vulnerabilities become much easier to exploit reliably. Enabling full ASLR is very low risk: it is the default on all modern distributions and is transparent to applications. The only known caveats are niche, some legacy debugging or JIT/large-memory workloads occasionally relax ASLR deliberately; if you run such software, validate it still functions. There is no lockout or networking impact, and the change is reversible by setting the value back.