avoid leaking kernel address information to userspace by using
kernel.kptr_restrict=1 sysctl