Did the WebKit developers mention as to why this is an option and not the default? What's the downside of turning it on? If it works just as well as RWX and is more secure it seems like it would just be the only code path.
They didn't give a reason, but the source code does (Source/JavaScriptCore/jit/ExecutableAllocator.cpp):
#if OS(WINDOWS)
#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
#endif
Change comments also indicate that there's a perf cost to WX, although later changes appear to have brought that down to something not very large. I doubt the perf is an issue for Steam so we will consider changing our WebKit build.
Apparently, WX_EXCLUSIVE is broken! This is apparently a long-standing bug with WebKit, reported over two years ago at Debian.
I found another ticket (about a year old) that should be the duplicate of my ticket (why they didn't flag it as duplicate is beyond me), which suggests an alternative:
Set the flags in Platform.h to compile in both the JIT & the interpreter. If the JIT buffer allocation fails it should automatically fall back to use the [interpreter].
So perhaps enabling WX_EXCLUSIVE is not the safest option, and instead, the fallback to the interpreter should be enabled.
Personally, I love most things the NSA drop to the open source commuity, but I've never liked SELinux. It wasn't really designed with home-based end-users in mind.
Today's Steam client beta has significant updates to the web support and may fix this.
Is this issue still active?
Closing pending information that this was not fixed by the CEF update.
Nothing extracted yet.
Steam for Linux apparently has issues with SELinux, see #88 for this. The WebKit developers responded that WebKit uses RWX memory by default (which is forbidden by SELinux), but that alternative code can be enabled through
ENABLE_ASSEMBLER_WX_EXCLUSIVE. Please investigate this option.