I believe it is the fact that it does not prevent buffer overflow
exploits. There was a big discussion a couple of years ago when someone
wanted a non-executable stack in Linux. It wasn't settled until Linus
showed how to modify exploits so they worked without actually executing
anything off the stack. (Hint: There are lots of things that can be
interesting to change without actually being executed, such as return
When Linux has a non-exec stack by default (or when everyone are on
x86-64), all the exploits will use those techniques instead. It's harder
to write, but most exploits aren't easy to write in the first place.
Either it needs to be completely safe, such as using range checking
compilers (taking the performance penalty) or we shouldn't have it at all
by default. Obscurity buys nothing.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds