Would you really have to call mprotect on OpenBSD? When SELinux is enforcing this on Linux, you don't. The trick is to map the page twice, once for writing and

Would you really have to call mprotect on OpenBSD? When SELinux is enforcing this on Linux, you don't. The trick is to map the page twice, once for writing and once for executing. Assuming both mappings are ASLR randomized, it's actually safer than allowing mprotect. SELinux actually has OpenBSD beat on this one: in some configurations, written pages can not be made executable.