Re: [PATCH 31/31] x86, pkeys: execute-only support

[Dave Hansen]

On 01/07/2016 01:02 PM, Kees Cook wrote:
>> > I haven't found any userspace that does this today.  With this
>> > facility in place, we expect userspace to move to use it
>> > eventually.
> And the magic benefit here is that linker/loaders can switch to just
> PROT_EXEC without PROT_READ, and everything that doesn't support this
> protection will silently include PROT_READ, so no runtime detection by
> the loader is needed.

Yep, completely agree.

I'll update the description.

>> > The security provided by this approach is not comprehensive.  The
> Perhaps specifically mention what it does provide, which would be
> protection against leaking executable memory contents, as generally
> done by attackers who are attempting to find ROP gadgets on the fly.

Good point.