Sure, but it still means that the OS has to decide who is allowed to do it and to what extent. Sophisticated worms like Stuxnet would be much harder with strict W^X for example, since CVE-2010-2568 and the like would be much harder to execute.
> Sure, but it still means that the OS has to decide who is allowed to do it and to what extent
It has to do that anyway?
Signed binaries with the proper assigned OS capabilities.
> Sure, but it still means that the OS has to decide who is allowed to do it and to what extent
It has to do that anyway?