https://bugs.exim.org/show_bug.cgi?id=2618
--- Comment #17 from Carlo Marcelo Arenas Belón <carenas@???> ---
(In reply to Saagar Jha from comment #16)
> (In reply to Carlo Marcelo Arenas Belón from comment #15)
> > indeed, I just implemented something similar for NetBSD W^X and the patch to
> > PCRE (including a whole new "allocator") seems simpler than what macOS might
> > need.
> >
> > mmap a region RW and then mprotecting it to RX after filling it would work?
> > it would seem that mmap succeeded though so is a fault the only way to know?
> >
> > AFAIK there are entitlements to cover that transition which I'll presume
> > should allow at least Intel to work if codesigning, would the same apply to
> > ARM?
>
> Using mprotect to flip the permissions, as long as W^X is maintained, should
> work without any additional code changes, although it will be slower than
> using the new pthread API. You will need an entitlement when running under
> the Hardened Runtime, IIRC it is
> com.apple.security.cs.allow-unsigned-executable-memory.
does this mean than applying the patch from Bug 2626 "solves" the issue?
note that you will need to also configure it with an additional setting to
enable the pre-alpha W^X compatible internal allocator and would obviously not
work if MAP_JIT was required.
regardless if it works, the solution by Stuart should be the only one that
should be added (once completed) in anything for mass production.
> A couple things: one, on macOS you basically "always" link against pthread,
> it's part of libSystem that pretty much every application links against by
> default. Just include pthread.h and make sure you are not linking statically
> (it's hard to mess this up accidentally) and you're good.
both sljit and pcre (as libraries) can be built statically and therefore
pthread.h might not be included; therefore build/configuration will need to be
updated.
> > am I wrong in consider pthread_jit_write_protect_np() calls something that
> > needs to be done regardless of CPU type as it seems to be mandated by the
> > API (included in macOS 11, and some yet undetermined versions for iOS and
> > friends)
>
> In summary: not required or even available on embedded platforms because you
> shouldn't be able to allocate RWX at all. Available on macOS 11.0+, on Intel
> does nothing because it is not necessary and on Apple silicon does the
> masking dance I mentioned earlier.
so this means that it should be #ifdef out to prevent build issues or all is
needed (unless your compiler is not clang from XCode) is the magic:
if (__builtin_available(macOS 11, *)
thanks for your explanations, and sorry if being slightly off-topic
--
You are receiving this mail because:
You are on the CC list for the bug.
