W^X support?

[mcandre]

Could the CloudABI runtime support an option to enforce W^X, in order to reduce the attack surface further? This would minimize the risk of escaping out of the CloudABI runtime into the host.

[EdSchouten]

Hi there!

CloudABI already enforces W^X, right? At least, that's what both the userspace emulator and the FreeBSD kernel implementation do.

[EdSchouten]

cloudabi/cloudabi.txt

Lines 579 to 580 in a3ae008

	| This implementation enforces the `W^X` property: Pages cannot be
	| mapped for execution while also mapped for writing.

[mcandre]

@EdSchouten Fascinating! What about macOS? Debian?