PIC my PIE

Hi folks,

Quite a lot of events happen since the last time. some awesome features mostly done by Shawn and Oliver like a mprotect protection which blocks a memory area to be set as executable if, it in first place, it was not set this way. An official Intel SMAP support was added lately. In my side, what I mentioned previously, arc4random (kernel and userland) updates (chacha 20 + minherit new flag INHERIT_ZERO) then adding getentropy syscall are done and merged. Plus, at the moment, I continue the work started by Shawn about the integration of PIC (Position Independant Code) on some libraries and PIE (Position Independant Executable) in a subset of binaries (let's say the most popular attack targets) ... for a start, rather than to apply it widely. The discussion about it started already on arch@ and it goes not badly ... The hope is, for sure, to push it upstream. Few of my under/overflow fixes on base were pushed (like sysctl) for last ...

As many of my fellows, I eat my own "dog food", hence I have a guenine laptop which runs HardenedBSD (and not only in a VM ;-)) daily, ... was important, for example, to test arc4random (used for so many things like creating processes id ...) widely by provoking many events ... compiling ... launching various daemons etc etc ... during hours.

Apart of pure technical topics, Shawn was able to desposit HardenedBSD and it is mentioned in FreeBSD Quaterly report ... Once ASLR is pushed upstream other security features would be as well ... Nice ! it is getting concrete :-)

For next, some features and fixes are planned. Plus a little something in my side ... hopefully ;-)