When writing software in a language such as C/C++, what tools/libraries/functions are available to help make the program more secure from exploitation on Linux?

For example: one can use chroot() and setuid() to constrain a process and drop privileges respectively. There are many other tools/libraries such as:

  • Libraries: Libseccomp, Libsafe, Libcap2, Libfuzzer
  • OS Controls: Linux Namespaces, chroot, setuid
  • Tools: Using stack canaries in GCC (-fstack-protector)

I realize that there are more tools such as SELinux, GrSecurity and Virtualization, but I am looking more for things that a programmer is responsible for doing vs. a sys-admin.


closed as too broad by Anders, Peteris, S.L. Barth, Xander, schroeder Dec 27 '16 at 17:20

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • this is really broad - the list of things could be endless - can you narrow your scope at all? – schroeder Dec 27 '16 at 17:20

Browse other questions tagged or ask your own question.