The key word is "by default". I have no idea whether the Linux kernel that each distro ships enforced W^X. For userland, the effort is undergoing. For instance,

The key word is "by default". I have no idea whether the Linux kernel that each distro ships enforced W^X. For userland, the effort is undergoing. For instance, I recently packaged a C application for Debian. Then, by sheer luck I stumbled upon the Debian Wiki[0] where it explained that one needs to specify "DEB_BUILD_MAINT_OPTIONS = hardening=+all" to enable compiler hardening options. Why isn't that on by default ? The wiki asks the reader to enable hardening if the program handles untrusted data. Doesn't that apply to 99% of the applications out there ? Even it only reads its own configuration file, there is a possibility of a bug in the parser. Why take the risk at all ? Enable it by default for everyone and be done with it. Regarding the pledge(2) sandboxing, pretty much every userland application in the base install of OpenBSD where is makes sense to sandbox is using pledge. Ports/packages are another story entirely. [0] https://wiki.debian.org/Hardening#Using_Hardening_Options https://wiki.debian.org/Hardening#Using_Hardening_Options