Rampant Paranoia ProPolice integrated stack protection, cross platform uses a canary value to check for overwrite in -current, kernel built with ProPolice required changes to some binaries PROT_EXEC purity line in the sand no READ and EXEC pages W^X fine-grained memory page controls fully POSIX compliant no page is PROT_WRITE and PROT_EXEC i386 support in -current