An attacker would have to set such a flag before the binary was loaded, meaning they've already achieved code execution (and syscalls). This feature is yet ano

An attacker would have to set such a flag before the binary was loaded, meaning they've already achieved code execution (and syscalls). This feature is yet another layer of defense against remote exploitation of a currently running program (for example, a web browser). It complements things such as ASLR, stack canaries, the NX bit, ...