Hacker News new | ask | show | jobs
by TazeTSchnitzel 4415 days ago
I thought the problem was code-signing, with Safari and only Safari authorised to use JIT.
2 comments

It is -- code-signing is how they enforce W^X. Only code loaded from signed applications is given pages with execute permission, and those pages are denied write access.
mmastrac is correct, the problem with JIT is W^X. The default sandbox for iOS processes prevents marking any page as executable that has ever been marked as writable. Safari is not "authorized to use JIT" so much as it has a special sandbox that lifts this restriction. It's not about code-signing, it's about the security provided by W^X. If it was merely about code-signing, the JIT could simply codesign its output using a certificate provided by Apple for this purpose.