On this page

OSSEC / HIDS Rule 60027

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 60027
  • Definition status: Present in current source
  • Alert message / subject: Denied a RWX mmap event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel.
  • Rule level: 8
  • Definition checked: 2026-10-21

Interpretation and response

A PaX/grsecurity memory-protection event was reported. It can reflect an attempted attack, an application compatibility issue or a legitimate executable-memory requirement. Investigate the program and kernel event.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

The kernel enforces the memory policy; the HIDS rule reports it. The event does not prove compromise, and the old blanket guarantees of exploit prevention were removed.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

A PaX/grsecurity memory-protection event was reported. It can reflect an attempted attack, an application compatibility issue or a legitimate executable-memory requirement. Investigate the program and kernel event.

Log examples

Illustrative event summary (not a captured log): OSSEC/HIDS 60027 — Denied a RWX mmap event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel..

Illustrative event summary (not a captured log): OSSEC/HIDS 60027 — Denied a RWX mmap event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel..

Illustrative event summary (not a captured log): OSSEC/HIDS 60027 — Denied a RWX mmap event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel..

Troubleshooting

Solutions

paxtest

Please see this article if you see this event for any paxtest events:

ASL error messages (historical reference)

PHP

The wiki described exceptions for older PHP/ASL combinations. Obtain version-specific guidance from support before changing memory protections or restarting production services.

Generic

Please see these article for solutions if your application requires to be run this way, and therefore has the mmap weakness:

ASL error messages (historical reference)

Java

Note: Java may require you to open other holes in your system. If you are attempting to allow Java to do this, please see this article:

ASL error messages (historical reference)

False Positives

Please report this to support if you know this is not an attack.

Additional Information

Similar Rules

HIDS_61027

External Articles

https://en.wikipedia.org/wiki/PaX#Restricted_mprotect.28.29

Source and revision

Migrated from HIDS_60027, wiki page 531, revision 5858 (20170602). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .