TBH preventing information leaks on any single system is a hopeless task:
there are far too many potential avenues, and when you get right down to
it they *are* one single system, so one process consuming a shareable
resource will always be observable by another process attempting to get
access to the same resource. (Crude example: time. Busywait, watching the
time: if it skips, you know someone else is using the same core.)
If you want to avoid information leaks, run the high-sensitivity no-leak
stuff on a different physical machine. Nothing else is safe enough for the
paranoid, and only the paranoid will really care about this anyway.