# Ensure address space layout randomization is enabled

Necessity: Address Space Layout Randomization (ASLR) is a critical security feature that mitigates memory corruption vulnerabilities, such as buffer overflows. It works by randomizing the memory locations of key process areas, including the stack, heap, and libraries. This makes it significantly more difficult for an attacker to predict target addresses and successfully execute exploits like return-oriented programming (ROP). Disabling or weakening ASLR exposes the system to a wide range of well-known and effective attack techniques.

Auditing and Remediation: The audit script verifies the system's ASLR configuration by reading the value of the 'kernel.randomize_va_space' sysctl parameter. The remediation script configures this parameter to the desired value, applying it to the live kernel and also saving it to a configuration file to ensure the setting persists across reboots.

Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is '2'. A value of '0' disables ASLR entirely. A value of '1' provides partial randomization but omits the heap, leaving a significant attack vector. A value of '2' enables full randomization, which is the most secure setting and the standard recommendation by security benchmarks like the Center for Internet Security (CIS). As this is the default on most modern systems and provides the only effective level of protection for this control, it is the required setting for any security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2']` |
| **Moderate** | `['2']` |
| **Strict** | `['2']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the current value from the '/proc/sys/kernel/randomize_va_space' file and outputs only the numerical value.

## Remediation Script Working

Bash script that accepts a single numerical value as a positional command-line argument. The script must set the 'kernel.randomize_va_space' parameter to this value in both the running configuration (using sysctl) and persistently in a file under '/etc/sysctl.d/'. The script must return 'true' on success and 'false' on failure.

