The LSM module should disallow mprotect() with PROT_EXEC

[dimkr]

This should make user-mode loaders (i.e attempts to mmap() the contents of an executable to memory, resolve all symbol addresses, handle relocation and jump to main()) unusable.

[mstewartgallus]

So you're disabling JITs as well?

[dimkr]

Yes, until there's is some JIT interpreter in RLSD. At the moment, it's useful only for shellcodes, packers and other dirty stuff.