Good point! However, if you go down that route in a web application, don't forget to pre-compile templates, and do the same for all other cached things that are

Good point! However, if you go down that route in a web application, don't forget to pre-compile templates, and do the same for all other cached things that are "code-like". More generall, I find W^X hard to enforce in typical web applications. Sure you can mount directory read-only, disable access to /tmp and observe what happens. But then they might use the database as template cache, or whatever. In most (web) application I'd be happy if they had a central directory where they write stuff into (bonus points for making that directory configurable), instead of scattering generated files all across the source tree.