Stack smashing attacks are the most common form of penetration attack. Programs that have been compiled with StackGuard are largely immune to stack smashing attack.
Protection requires no source code changes at all.
When a vulnerable program is attacked, StackGuard detects the attack in progress, raises an intrusion alert, and halts the victim program. SubDomain SubDomain is a kernel extension designed to provide least privilege confinement to suspect programs. SubDomain allows the administrator to specify the domain of activities the program can perform by listing the files the program may access, and the operations the program may perform. SubDomain restrictions complement the kernel's native access controls, in that SubDomain never expands the set of files a program may access, i.e. any file access must pass the native access controls and the SubDomain restrictions before access is granted. Thus SubDomain confinement makes a program monotonically safer to run.