OpenBSD 6.0 has been released. Among the changes listed in the release announcement are removal of Linux emulation, systrace, the usermount option, and the VAX port.
W^X is now strictly enforced by default; a program can only violate it if the executable is marked with PT_OPENBSD_WXNEEDED and is located on a filesystem mounted with the wxallowed mount(8) option.
So the mandatory W^X announcement worried me for a moment, as it would break things like JRE, Mono, HHVM, Node, and web browsers. After a bit of searching, I discovered that OpenBSD's W^X policy does allow a JIT to flip pages from RW to RX explicitly by calling mprotect() (available in Linux [man7.org] and OpenBSD [openbsd.org]), as SpiderMonkey (the ECMAScript interpreter in Firefox) has done since version 46 [jandemooij.nl].
Does OpenBSD offer a way to block a process from flipping pages from RW to RX? Or are PT_OPENBSD_WXNEEDED and wxallowed related to that?
(Score: 3, Interesting) by Pino P on Friday September 02 2016, @04:20PM
W^X is now strictly enforced by default; a program can only violate it if the executable is marked with PT_OPENBSD_WXNEEDED and is located on a filesystem mounted with the wxallowed mount(8) option.
A growing number of platforms enforce a W^X policy incompatible with JIT [twitter.com], forbidding unprivileged processes from requesting that a page be flipped from RW (read and write) to RX (read and execute). This reportedly includes iOS, UWP, and current video game consoles.
So the mandatory W^X announcement worried me for a moment, as it would break things like JRE, Mono, HHVM, Node, and web browsers. After a bit of searching, I discovered that OpenBSD's W^X policy does allow a JIT to flip pages from RW to RX explicitly by calling mprotect() (available in Linux [man7.org] and OpenBSD [openbsd.org]), as SpiderMonkey (the ECMAScript interpreter in Firefox) has done since version 46 [jandemooij.nl].
Does OpenBSD offer a way to block a process from flipping pages from RW to RX? Or are PT_OPENBSD_WXNEEDED and wxallowed related to that?