<story><title>W^X now mandatory in OpenBSD</title><url>http://undeadly.org/cgi?action=article&amp;sid=20160527203200</url></story><parent_chain><item><author>near</author><text>I&amp;#x27;ve always been in favor of all OpenBSD security enhancements I&amp;#x27;ve seen, but I have to say, and please hear me out, this is an objectively terrible idea.&lt;p&gt;Yes, most programs should disallow W|X by default. But trying to banish the entire practice with a mount flag, knowing full well few people will go that far to run a W|X application, is bad practice. I&amp;#x27;d rather see this as another specialty chmod flag ala SUID, SGID, etc. Or something along those lines. One shouldn&amp;#x27;t have to enable filesystem-wide W|X just to run one application.&lt;p&gt;The thing is, when you actually &lt;i&gt;do&lt;/i&gt; need W|X, there is no simple workaround. Many emulators and JITs &lt;i&gt;need&lt;/i&gt; to be able to dynamically recompile instructions to native machine code to achieve acceptable performance (emulating a 3GHz processor is just not going to happen with an interpreter.) For a particularly busy dynamic recompiler, having to constantly call mprotect to toggle the page flags between W!X and X!W will impact performance too greatly, since that is a syscall requiring a kernel-level transition.&lt;p&gt;We also have app stores banning the use of this technique as well. This is a very troubling trend lately; it is throwing the baby out with the bathwater.&lt;p&gt;EDIT: tj responded to me on Twitter: &amp;quot;the per-mountpoint idea is just an initial method; it&amp;#x27;ll be refined as time goes on. i think per-binary w^x is in the pipeline.&amp;quot; -- that will not only resolve my concerns, but in fact would be my ideal design to balance security and performance.</text></item></parent_chain><comment><author>burfog</author><text>Would you really have to call mprotect on OpenBSD?&lt;p&gt;When SELinux is enforcing this on Linux, you don&amp;#x27;t. The trick is to map the page twice, once for writing and once for executing. Assuming both mappings are ASLR randomized, it&amp;#x27;s actually safer than allowing mprotect.&lt;p&gt;SELinux actually has OpenBSD beat on this one: in some configurations, written pages can not be made executable.</text></comment>
<story><title>W^X now mandatory in OpenBSD</title><url>http://undeadly.org/cgi?action=article&amp;sid=20160527203200</url></story><parent_chain><item><author>near</author><text>I&amp;#x27;ve always been in favor of all OpenBSD security enhancements I&amp;#x27;ve seen, but I have to say, and please hear me out, this is an objectively terrible idea.&lt;p&gt;Yes, most programs should disallow W|X by default. But trying to banish the entire practice with a mount flag, knowing full well few people will go that far to run a W|X application, is bad practice. I&amp;#x27;d rather see this as another specialty chmod flag ala SUID, SGID, etc. Or something along those lines. One shouldn&amp;#x27;t have to enable filesystem-wide W|X just to run one application.&lt;p&gt;The thing is, when you actually &lt;i&gt;do&lt;/i&gt; need W|X, there is no simple workaround. Many emulators and JITs &lt;i&gt;need&lt;/i&gt; to be able to dynamically recompile instructions to native machine code to achieve acceptable performance (emulating a 3GHz processor is just not going to happen with an interpreter.) For a particularly busy dynamic recompiler, having to constantly call mprotect to toggle the page flags between W!X and X!W will impact performance too greatly, since that is a syscall requiring a kernel-level transition.&lt;p&gt;We also have app stores banning the use of this technique as well. This is a very troubling trend lately; it is throwing the baby out with the bathwater.&lt;p&gt;EDIT: tj responded to me on Twitter: &amp;quot;the per-mountpoint idea is just an initial method; it&amp;#x27;ll be refined as time goes on. i think per-binary w^x is in the pipeline.&amp;quot; -- that will not only resolve my concerns, but in fact would be my ideal design to balance security and performance.</text></item></parent_chain><comment><author>yoklov</author><text>&amp;gt; One shouldn&amp;#x27;t have to enable filesystem-wide W|X just to run one application&lt;p&gt;This is a very good point, and it seems like enabling it more granularly would be worth it.&lt;p&gt;But, for your second point, I have trouble believing that switching between W!X and X!W is going to happen frequently enough to be substantial for performance. (It was very small in Firefox&amp;#x27;s JavaScript JIT, causing something like a 1%-4% performance hit depending on system).</text></comment>