Defending Against the Chain

• Full RELRO (-z relro -z now): read-only GOT defeats GOT overwrite.
• PIE + ASLR: randomize the main binary too, not just libc, so even code-reuse gadgets in the program move.
• Eliminate info leaks: no bug is more valuable to an attacker than an address leak. Bounds-check reads, never print raw memory, avoid format-string bugs (-Wformat -Wformat-security).
• CFI (Control-Flow Integrity): validate indirect call/jump targets so a corrupted pointer cannot redirect to system or a gadget.
• Stack canaries, fortify source, safe libraries: shrink the set of usable primitives in the first place.