OpenBSD founder Theo de Raadt first proposed a new system call, called
mimmutable(), at the beginning of September. After numerous revisions, the system call looks to be merged as:
int mimmutable(void *addr, size_t len);
A call to
mimmutable()will render the mapping of the
lenbytes of memory starting at
addrimmutable, meaning that the kernel will not allow any changes to either the memory protections or the mapping in that range. As a result, system calls like
mprotect()that would affect that range will, instead, fail.