Practical guide on out of tree mitigations on Linux
Summary
An in-depth guide on hardening Linux apps using out-of-tree mitigations, focusing on hardened allocators, syscall and path restrictions in systemd, and containment techniques such as noexec and restricted paths. It includes practical configuration examples and discusses advanced topics like CET/Shadow Stack and building a custom glibc for defense.