PaX prevents pages from being marked executable if they were ever writable, even if they are first (or simultaneously) marked non-executable. This means that n

PaX prevents pages from being marked executable if they were ever writable, even if they are first (or simultaneously) marked non-executable. This means that no JITs are compatible with PaX. Not allowing pages to be simultaneously executable and writable has a lot of merit, but the stricter restrictions of PaX are a hard sell. It would be nice if PaX had an option to just disallow pages that are simultaneously writable and executable. It would be interesting to see a model where processes that were very restricted via the Linux Capabilities framework were allowed to execute pages that were once (but no longer) writable. This would allow programs such as browsers to run JITs in OS-level sandboxes. Edit: actually, I wonder if PaX allows shared pages that are executable in one process and writable in another. That would be another interesting model.