On Wednesday 09 June 2004 20:14, Jesper Juhl wrote:
> On Tue, 8 Jun 2004, Robert White wrote:
> > I would think that having an easy call to disable the NX modification
> > would be both safe and effective.  That is, adding a syscall (or
> > whatever) that would let you mark your heap and/or stack executable while
> > leaving the new default as NX, is "just as safe" as flagging the
> > executable in the first place.
>
> Just having the abillity to turn protection off opens the door. If it is
> possible to turn it off then a way will be found to do it - either via
> buggy kernel code or otherwhise. Only safe approach is to have it
> enabled by default and not be able to turn it off IMHO.

What about turning it on and don't be able to turn it off again?

> Jesper Juhl <juhl-lkml@dif.dk>
<<V13>>