Hi all, I want to share this with you because I found it simply impressive:It seems that recent kernels through .config allows to set up how many randomization bits shall be set to ASLR as an switchable option. Here is the result.
Probably you would need one MAC option to protect Writeable text segments and mprotect, but you could benefict of an increased ASLR strength. The system is a Rockpi4SE
Mode: 1 Blackhat Kernel:Linux cerberus 6.18.16-rsbac #1 SMP PREEMPT_RT Sat Mar 7 17:12:12 CET 2026 aarch64 GNU/Linux
Relase information: LSB Version: n/a Distributor ID: Gentoo Description: Gentoo Linux Release: 2.18 Codename: n/a Test results:/usr/bin/paxtest: línea 69: /usr/lib64/paxtest/aarch64-unknown-linux-gnu-gcc: No existe el fichero o el directorio
Executable anonymous mapping : Killed Executable bss : Killed Executable data : Killed Executable heap : Killed Executable stack : Killed Executable shared library bss : Killed Executable shared library data : Killed Executable anonymous mapping (mprotect) : Killed Executable bss (mprotect) : Killed Executable data (mprotect) : Killed Executable heap (mprotect) : Killed Executable stack (mprotect) : Killed Executable shared library bss (mprotect) : Killed Executable shared library data (mprotect): Killed Writable text segments : Killed Anonymous mapping randomization test : 30 quality bits (guessed) Heap randomization test (ET_EXEC) : 30 quality bits (guessed) Heap randomization test (PIE) : 30 quality bits (guessed) Main executable randomization (ET_EXEC) : 26 quality bits (guessed) Main executable randomization (PIE) : 27 quality bits (guessed) Shared library randomization test : 26 quality bits (guessed) VDSO randomization test : 30 quality bits (guessed) Stack randomization test (SEGMEXEC) : 26 quality bits (guessed) Stack randomization test (PAGEEXEC) : 26 quality bits (guessed) Arg/env randomization test (SEGMEXEC) : 18 quality bits (guessed) Arg/env randomization test (PAGEEXEC) : 18 quality bits (guessed) Offset to library randomisation (ET_EXEC): 26 quality bits (guessed) Offset to library randomisation (ET_DYN) : 26 quality bits (guessed) Randomization under memory exhaustion @~0: 30 bits (guessed) Randomization under memory exhaustion @0 : 30 bits (guessed)Return to function (strcpy) : paxtest: return address contains a NULL byte. Return to function (memcpy) : Return to function (strcpy, PIE) : paxtest: return address contains a NULL byte.
Return to function (memcpy, PIE)
OpenPGP_0x57E64E0B7FC3BEDF.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
