3.3. Kernel Address Space Randomization
Red Hat Enterprise Linux 7.5 and later include the Kernel Address Space Randomization (KASLR) feature for KVM guest virtual machines. KASLR enables randomizing the physical and virtual address at which the kernel image is decompressed, and thus prevents guest security exploits based on the location of kernel objects.
KASLR is activated by default, but can be deactivated on a specific guest by adding the
nokaslr string to the guest's kernel command line. To edit the guest boot options, use the following command, where guestname is the name of your guest:
# virt-edit -d guestname /etc/default/grub
Afterwards, modify the
GRUB_CMDLINE_LINUX line, for example:
GRUB_CMDLINE_LINUX="rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet nokaslr"
Important
Guest dump files created from guests that have with KASLR activated are not readable by the
crash utility. To fix this, add the <vmcoreinfo/> element to the <features> section of the XML configuration files of your guests.
Note, however, that migrating guests with
<vmcoreinfo/> fails if the destination host is using an OS that does not support <vmcoreinfo/>. These include Red Hat Enterprise Linux 7.4 and earlier, as well as Red Hat Enterprise Linux 6.9 and earlier.
