SecurityMitigations [FreeBSD WIKI]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

^ Technique ^ HEAD rev / patch ^
| //Prevent memory access in privileged modes// ||
| amd64 Supervisor Mode Access Prevention (SMAP) | [[https://svnweb.freebsd.org/changeset/base/336876|r336876]] |
| arm64 Privileged Access Never (PAN) | [[https://svnweb.freebsd.org/changeset/base/316756|r316756]] |
| //Prevent execution in privileged modes// ||
| amd64 Supervisor Mode Execution Prevention (SMEP) | [[https://svnweb.freebsd.org/changeset/base/242433|r242433]] |
| arm64 Privileged Execute Never (PXN) | [[https://svnweb.freebsd.org/changeset/base/316761|r316761]] |
| //Limit permissions on kernel memory// ||
| Direct map | [[https://svnweb.freebsd.org/changeset/base/316767|r316767]] |
| Kernel stacks | [[https://svnweb.freebsd.org/changeset/base/329281|r329281]] |
| Recursive page table mappings | [[https://svnweb.freebsd.org/changeset/base/330511|r330511]] |
| Kernel .text, .data, .bss | [[https://svnweb.freebsd.org/changeset/base/330539|r330539]] |
| UMA and malloc(9) | [[https://svnweb.freebsd.org/changeset/base/335068|r335068]] |
| pipe_map and exec_map | [[https://svnweb.freebsd.org/changeset/base/340205|r340205]] |
| Kernel module .text, .data, .bss | PR 228927 |

The topic was discussed at the August 2017 Cambridge Summit - notes at [[DevSummit/201708/Security_mitigation]]