OpenBSD: - Compile Kernel from source. Easy: - Change the kernel message buffer messages from that horrendous blue. Easy - Medium: - Remove support for the crusty a.out file format. Hard: Kernelspace (Simple and Eloquent): - Add full ASLR for static binaries. Binary must satisfy the following: - Is ET_EXEC. - Choose base address for all relocations that have a base address of 0. Kernel is assuming PIC. - Populate the SBT (Section Base Table) with all addresses chosen by kernel. - Is ET_DYN. - Remain unchanged. - High level steps: - Walk the relocation tables (DT_RELA/DT_REL). - Get an offset address for each segment. - Make sure mapped segments are all valid and non-overlapping. - Populate the SBT (Section Base Table) with the new base offsets. - When finished map the SBT as read only. Userspace: - ET_EXEC: - Produce position independent code that references the offsets in the SBT (Section Base Table) below the .text section. - Mark all sections relocatable with a base address of 0. - ET_DYN: - Unchanged. - Need a linker that adheres to this behaviour. - Current linkers assumes single slider for all segments. - Patch linker to produce binaries with the previous requirements. exec() system call: - Maybe add pre-faulted pages for select segments. - Re-compile Kernel with new changes.