IIRC it's part of the sandbox apps run in, which, in turn, makes use of the hardware memory protection. To do JIT, you need to first write your dynamically gene

IIRC it's part of the sandbox apps run in, which, in turn, makes use of the hardware memory protection. To do JIT, you need to first write your dynamically generated code into the memory, and then execute it. The memory you obtain via e.g. malloc() doesn't allow execution, only reading and writing (this is controlled by permission flags, in the page table, on the memory pages your app is given by the kernel). To obtain memory that is both writable and executable, you call mmap() specifying corresponding flags. The kernel just refuses to allocate such memory for your app because it doesn't have necessary permissions, or "entitlements" in Apple speak.