2 ms·
> It would at least be nice if they made W^X exec() into a permission W^X is what Android is pushing people towards, there's no reason for a permission to guar
by kllrnohj 5y ago
> It would at least be nice if they made W^X exec() into a permission
W^X is what Android is pushing people towards, there's no reason for a permission to guard what's recommended.
And it doesn't restrict any useful behavior. It does require some design burden to do properly, though, which not everyone is willing to do. But eg Chrome & Firefox have no issues with their JavaScript JITs that still comply with W^X.
- NotPractical 5y agoI meant a permission to circumvent the W^X restriction. > And it doesn't restrict any useful behavior. It does require some design burden to do properly, though, which not everyone is willing to do. Do you know of any alternative approach to the gross APK packaging one? I would say it definitely restricts "useful behavior", unless you think Termux would be just as useful after API 29 compatibility were implemented (and I would disagree). Besides, when thinking about implementing a security feature, the question "does this restrict behavior?" is important (and I think it does in this case), but not quite as relevant as the question "what actual extra security does this provide?", and I'm not quite sure how much extra security this provides. Could someone provide a realistic attack scenario?