FYI: If you're comfortable with Gentoo, the jump to Hardened Gentoo[1] is an easy one[2] and gives TrustedBSD[3] a run for its money w/r/t out-of-the-box securi

FYI: If you're comfortable with Gentoo, the jump to Hardened Gentoo[1] is an easy one[2] and gives TrustedBSD[3] a run for its money w/r/t out-of-the-box security. It has the SElinux MAC, role based access controlled stuff from GRsec alternatively [you can mix and match GRsec + SElinux except for RBAC and SElinux's ACL system), grsec's ASLR at runtime, modified versions of musl/uclibc, stack protection support (why anyone would write software that could possibly be EIP exploited with countless ASan damn well integrated into some compilers, I haven't a clue), and a whole host more. Some interesting academic work: http://hmarco.org/data/OnTheEffectivness-NX-SSP-RenewSSP-and-ASLR.pdf http://hmarco.org/data/OnTheEffectivness-NX-SSP-RenewSSP-and... While SSP is not enough, (use PIE too): http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.ht... A fun toy: https://github.com/JhetoX/VectorAttackScanner https://github.com/JhetoX/VectorAttackScanner [1]https://wiki.gentoo.org/wiki/Project:Hardened https://wiki.gentoo.org/wiki/Project:Hardened [2]https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Harden... [3]Granted I haven't used it in ages, it's still the benchmark I use in my mind, back when Linux 2.2 was rife with out-of-the-box ROP vulns.