Hardware technologies for securing containers

> The supervisor mode access protection (SMAP) and execution prevention (SMEP) features of some x86 processors
> are changing some of things that we learned in school about CPUs, Van de Ven said.

actually it's PaX that brought that change into the world with KERNEXEC (2003) and UDEREF (2006). SMEP (3 years old) and SMAP (<1 year old) are inadequate substitutes unfortunately as they both suffer from bad designs (e.g., SMAP ties the override capability to highly volatile processor state instead of read-only code and data).