search

commoncriteria / operatingsystem

Protection Profile for Operating Systems
The Unlicense
9 stars 6 forks source link

FPT_ASLR_EXT.1.1 - permit no kernel ASLR? #45

Closed jeffblank closed 9 years ago

jeffblank commented 9 years ago

allow as selection?

kgal commented 9 years ago

Verified to exist in OSX, Linux, Windows. Not verified in Solaris.

ajcousi commented 9 years ago

It's in Solaris 11 http://docs.oracle.com/cd/E26502_01/html/E29015/concept-13.html#concept-aslr-1

http://docs.oracle.com/cd/E36784_01/html/E36837/conf-aslr.html

Not sure how to check that the "system wide" setting does KASLR though :(

kgal commented 9 years ago

I don't see kernel ASLR in that document, just ASLR and how ASLR pertains to zones.

alexbarclay commented 9 years ago

Solaris 11 does not have Kernel ASLR support.

There are valid criticisms re: KASLR - see https://forums.grsecurity.net/viewtopic.php?f=7&t=3367. What's the security goal and threat model for this requirement?

kgal commented 9 years ago

As these criticisms seem valid, I've broken out KASLR into a separate optional requirement.