documentation_complete: true

prodtype: rhel7,fedora

title: 'Enable ExecShield'

description: "By default on Red Hat Enterprise Linux 7 64-bit systems, ExecShield\nis enabled and can only be disabled if the hardware does not support ExecShield\nor is disabled in <tt>/etc/default/grub</tt>. For Red Hat Enterprise Linux 7 \n32-bit systems, <tt>sysctl</tt> can be used to enable ExecShield."

rationale: "ExecShield uses the segmentation feature on all x86 systems\nto prevent execution in memory higher than a certain address. It\nwrites an address as a limit in the code segment descriptor, to\ncontrol where code can be executed, on a per-process basis. When\nthe kernel places a process's memory regions such as the stack and\nheap higher than this address, the hardware prevents execution in that\naddress range. This is enabled by default on the latest Red Hat and Fedora \nsystems if supported by the hardware."

severity: medium

identifiers:
    cce@rhel7: 27211-2

references:
    cis: 1.5.2
    cui: 3.1.7
    disa: 2530
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3),164.308(a)(4),164.310(b),164.310(c),164.312(a),164.312(e)
    nist: SC-39

ocil_clause: 'ExecShield is not supported by the hardware, is not enabled, or has been disabled by the kernel configuration.'

ocil: |-
    To verify ExecShield is enabled on 64-bit Red Hat Enterprise Linux 7 systems,
    run the following command:
    <pre>$ dmesg | grep '[NX|DX]*protection'</pre>
    The output should not contain <tt>'disabled by kernel command line option'</tt>.
    To verify that ExecShield has not been disabled in the kernel configuration,
    run the following command:
    <pre>$ sudo grep noexec /boot/grub2/grub.cfg</pre>
    The output should not return <tt>noexec=off</tt>.
    For 32-bit Red Hat Enterprise Linux 7 systems, run the following command:
    <pre>$ sysctl kernel.exec-shield</pre>
    The output should be:
    <pre><sysctl-desc-macro sysctl="kernel.exec-shield" value="1" /></pre>
