All projects

Kernel Security · 2024–2025

xv6 OS Security Enhancements

Implemented kernel-level security mitigations in xv6, MIT's teaching operating system — turning a deliberately minimal kernel into a testbed for modern exploit mitigations.

  • C
  • xv6
  • ASLR
  • W^X
  • Stack Canaries
  • System Calls
  • RISC-V

Approach

The work covers ASLR (randomizing user-space layout at exec time), W^X memory policies (no page both writable and executable), stack canaries with kernel-side verification, and strengthened process isolation. I also built custom system calls for security auditing, so the kernel can report its own mitigation state.

Doing this in xv6 rather than Linux means every mitigation had to be built from first principles — page-table manipulation, trap-frame handling, and ELF loading included. The project grew out of the Lind sandbox research group at NYU.

Highlights

  • ASLR, W^X, and stack canaries implemented from scratch in a minimal kernel
  • Custom syscalls for querying and auditing mitigation state
  • Memory-safety analysis of the resulting attack surface
  • Companion work to NYU's Lind sandbox research

Artefacts