For extra security, CONFIG_SEAL_METADATA=true can be used in order to
control whether Memory Protection Keys are used to disable access to all writable
allocator state outside of the memory allocator code. It's currently disabled by default
- due to a significant performance cost for this use case on current generation hardware.
+ due to a significant performance cost for this use case on current-generation hardware.
Whether or not this feature is enabled, the metadata is all contained within an isolated
- memory region with high entropy random guard regions around it.
For low-memory systems, VARIANT=light can be used to compile the light
variant of hardened_malloc, which sacrifices some security for much less memory
usage. This option still produces a more hardened memory allocator than both the