From ee12864ce02a1757477b579221869fbcf1e87e2a Mon Sep 17 00:00:00 2001
From: inference Add For extra security, For all compile-time options, see the
configuration section
- of hardened_malloc’s extensive official documentation.Increase Permitted Amount of Memory Pages
vm.max_map_count = 1048576
to
- /etc/sysctl.conf
to accommodate hardened_malloc’s large
+ /etc/sysctl.conf
to accommodate hardened_malloc's large
amount of guard pages.CONFIG_SEAL_METADATA=true
can be
used in order to control whether Memory Protection Keys are used to
disable access to all writable allocator state outside of the memory
- allocator code. It’s currently disabled by default due to a significant
+ allocator code. It's currently disabled by default due to a significant
performance cost for this use case on current generation hardware.
Whether or not this feature is enabled, the metadata is all contained
within an isolated memory region with high entropy random guard regions
@@ -96,7 +96,7 @@
security for much less memory usage.