Apps should be statically linked and the kernel should not allow any access to the hdd or fs. Where you have to opt in to what folders the app is able to read or write to. Same for network access and any other hardware, camera, mic, etc.
Frequently those static libraries provide device-specific functionality. For example, the
Jpeg decompressor on my phone uses custom silicon, and is a systemwide shared library.
Comments
Apps should be statically linked and the kernel should not allow any access to the hdd or fs. Where you have to opt in to what folders the app is able to read or write to. Same for network access and any other hardware, camera, mic, etc.
Frequently those static libraries provide device-specific functionality. For example, the Jpeg decompressor on my phone uses custom silicon, and is a systemwide shared library.
Is there any way to make memory pages executable, but not readable?
Kernel modules are executable, but not readable (by userspace processes). Or just have it in a different process and talk over IPC.