W ^ X Shorthand for: PROT_WRITE xor PROT_EXEC Goal: In regular process, ensure no page is mapped both PROT_EXEC and PROT_WRITE simultaneously Handle GOT/PLT exec on some... not on others.. ld.so must know about modifying those (and signal blocking) kernel must map ld.so more carefully Making this change took a lot of time Not violating POSIX