> How does this stop an attacker doing the same via ROP? Wait, isn't that backwards? Doesn't the use of W^X necessitate the use of ROP? Right now a JIT has lot

> How does this stop an attacker doing the same via ROP? Wait, isn't that backwards? Doesn't the use of W^X necessitate the use of ROP? Right now a JIT has lots of memory that is W&X so you just need a memory exploit to inject some code and then find a way to jump to it, no need for ROP. But if you implement W^X this won't work because now you can't inject code with just a memory exploit, you also have to set it to executable with mprotect(2). So instead you use ROP, and inject only data which includes jumps to carefully selected sections of code in libc, etc, that implements an exploit. I mean you could probably use ROP to run mprotect, but by that point it's pointless because you're already running code on the system right?