Hardening a C Binary on Linux

Fri, 09 Oct 2026 00:00:00 +0000

I opened DistroWatch after a long time and came across HardenedBSD. Comparing it with FreeBSD and OpenBSD, which I’m more familiar with, led me to explore the hardening techniques used by HardenedBSD and OpenBSD. I decided to document a few of those techniques through small experiments, following each defense from the build option that enables it to the change it makes in program behavior.

I’m using C because a small program lets me trace a memory operation into the generated instructions, making both an unsafe copy and the checks added to defend it visible. C is central to the Linux kernel, SQLite, Redis, NGINX, and the Asterisk telephony platform; it is also the native extension language for CPython. Understanding these mechanisms is therefore useful even when the application itself is written in another language.

Arm on Rohit Jha

Hardening a C Binary on Linux