Locking it down: ideas

• if any check fails, kill the process, uncatchable: sigexit()

  • only permit kbind() syscall from one address

  • pass a per-process cookie

  • pass a per-thread cookie that the kernel updates on each call

  • pass the kernel both the expected old data and the new data

  • mark the mappings which kbind() is allowed to alter with a new mprotect() bit

  • mark the GOT and PLT as not permitting further mprotect() changes

  • mark dynamic linker code and data as not permitting munmap() or further mprotect() changes