security


stricter enforcement of W^X in the kernel address space

reallocarray: prevents integer overflows
sweep over the whole tree to make use of it

re-seed RNG on resume / unhibernate
also helps on VMs

static PIE on almost all architectures
those that support PIE
statically linked binaries have randomly located text segments