3.3. Kernel Address Space Randomization

Red Hat Enterprise Linux 7.5 and later include the Kernel Address Space Randomization (KASLR) feature for KVM guest virtual machines. KASLR enables randomizing the physical and virtual address at which the kernel image is decompressed, and thus prevents guest security exploits based on the location of kernel objects.

KASLR is activated by default, but can be deactivated on a specific guest by adding the nokaslr string to the guest's kernel command line. To edit the guest boot options, use the following command, where guestname is the name of your guest:

virt-edit -d guestname /etc/default/grub

# virt-edit -d guestname /etc/default/grub

Afterwards, modify the GRUB_CMDLINE_LINUX line, for example:

GRUB_CMDLINE_LINUX="rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet nokaslr"

GRUB_CMDLINE_LINUX="rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet nokaslr"