# Ensure address space layout randomization is enabled

Necessity: Address Space Layout Randomization (ASLR) is a critical security feature that mitigates memory corruption vulnerabilities, such as buffer overflows. It works by randomizing the memory locations of key process areas, including the executable, stack, heap, and libraries. This makes it significantly more difficult for an attacker to predict target addresses and successfully execute malicious code. Disabling ASLR (a value of 0) removes this defense-in-depth layer, leaving the system highly susceptible to a wide range of common exploits.

Auditing and Remediation: The audit script checks the current ASLR setting by querying the 'kernel.randomize_va_space' sysctl parameter. The remediation script modifies this parameter in the live kernel configuration and also writes the change to a file under '/etc/sysctl.d/' to ensure the setting persists after a system reboot.

Recommended State Rationale: The value of this setting determines the extent of randomization. 
- Basic: A value of '[1, 1]' enables conservative randomization. It randomizes the stack, memory mapping segment, and VDSO page. This provides a baseline level of protection. 
- Moderate: A value of '[2, 2]' enables full randomization. In addition to the protections of state 1, it also randomizes the heap via brk() calls. This is the default on most modern Linux systems and is the widely accepted best practice for strong security.
- Strict: A value of '[2, 2]' represents the most secure configuration available through this parameter. As there is no higher level, the Strict recommendation is the same as Moderate, ensuring the strongest possible protection against memory-based attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 2]` |
| **Moderate** | `[2, 2]` |
| **Strict** | `[2, 2]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that reads the value of the 'kernel.randomize_va_space' kernel parameter using 'sysctl -n'. The script must output only the numerical value (e.g., '2') and no other text or formatting.

## Remediation Script Working

Bash script that accepts a single numerical command-line argument. The script must set the 'kernel.randomize_va_space' parameter to this value for the running system using 'sysctl -w' and make the change persistent by adding or updating the setting in a configuration file within '/etc/sysctl.d/'. The script must output 'true' on success or 'false' on failure.

