OK; many thanks. My 32F417 does have an MPU but with just 8 areas whereas I have some 20 RTOS tasks.
Have you read the linked FreeRTOS article?
Protecting each task individually is not really advisable (or even possible without pointless contortions).
I use the MPU to prevent caching for some DMA buffers, while I am at it I also make the ITCM and external QSPI not writable, and all data RAM areas not executable, so FreeRTOS stacks and heap (and all the rest) are 'protected'.
This happens after static variables (optional) and ITCM (mandatory) are initialized by the startup code.
This helps not for security, given the application, rather to give a MemFault error in (some) case of a rogue function or data pointer.
Not that the linker is aware of this, though.
![Confused :-//](https://www.eevblog.com/forum/Smileys/default/confused0024.gif)
As for the "constructor" attribute, it might be useful to initialize HW needed before main starts, like e.g. external memories.
I have my own startup code, so I don't really have an use it, but it comes handy if you want to use the standard one.
OTOH the vendor/CMSIS standard startup code declares a SystemInit() weak function to put your stuff into.