Hi Andrew. It looks like in a course of a discussion people agreed that at least for MAP_PRIVATE the MNT_NOEXEC check makes no sense (no one spoke up otherwise, at least). The attached patch removes the check for MAP_PRIVATE but leaves for MAP_SHARED for now, as this was not agreed on. Reasons: - MAP_PRIVATE should not behave like that, "ro" and PROT_WRITE is a witness ("ro" doesn't deny PROT_WRITE for MAP_PRIVATE). - This is not a security check - file-backed MAP_PRIVATE mmaps can just be replaced with MAP_PRIVATE | MAP_ANONYMOUS mmap and read(). - The programs (like AFAIK wine) use MAP_PRIVATE mmaps to access the windows dlls, which are usually on a "noexec" fat or ntfs partitions. Wine might be smart enough not to break but fallback to read(), but this is slower and more memory-consuming. Some other program may not be that smart and break. So there is clearly a need for MAP_PRIVATE with PROT_EXEC on the noexec partitions. Sign-off: Stas Sergeev