Module 7 of 8

Security & Hardening

Secure coding, exploit mitigation, capability-based sandboxing, seccomp filters, SELinux/AppArmor policies, and supply-chain integrity.

4 lessons

~28 hours

180 XP

Eliminate classes of vulnerabilities: buffer overflows, integer wrap, use-after-free, format strings, and TOCTOU races.

Design a syscall policy, build a seccomp filter with libseccomp, and use Landlock for filesystem sandboxing on modern kernels.

Drop root privileges with capability bounding sets, write SELinux policy modules, and confine applications with AppArmor profiles.

Generate SBOMs with CycloneDX, achieve bit-for-bit reproducible builds, sign artifacts with cosign/sigstore, and verify in CI/CD.