Description of problem:

Based on performance impact analysis of the page_alloc.shuffle=1 done in bug 2042500 and the security impact assessment, we'd like a new SCAP rule to be added to RHEL 9 OSPP SCAP profile to set the page_alloc.shuffle=1 kernel command line parameter.

Per https://cateee.net/lkddb/web-lkddb/SHUFFLE_PAGE_ALLOCATOR.html, the CONFIG_SHUFFLE_PAGE_ALLOCATOR config option is primarily focused on improving the average utilization of a direct-mapped memory-side-cache. Aside of this performance effect, it also reduces predictability of page allocations in situations when the the bad actor can crash the system and somehow leverage knowledge of (page) allocation order right after a fresh reboot, or can control the timing between a hot-pluggable memory node (as in NUMA node) and applications allocating memory ouf of that node. The page_alloc.shuffle=1 kernel command line parameter then forces this functionality irrespectively of memory cache architecture.

Adding this parameter is not directly related to any SFR, it is a preventive measure against potential future vulnerabilities.

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.60-1.el9

How reproducible:

Deterministic.

Steps to Reproduce:
1. oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
2. reboot
3. cat /proc/cmdline
4. grep page_alloc.shuffle=1 /proc/cmdline
5. cat /sys/module/page_alloc/parameters/shuffle

Actual results:

/proc/cmdline does not contain page_alloc.shuffle=1
/sys/module/page_alloc/parameters/shuffle may contain N, especially on a VM.

Expected results:

/proc/cmdline does contains page_alloc.shuffle=1
/sys/module/page_alloc/parameters/shuffle contains Y

Additional info: