[NaCl SDK] nacl_io: Fix dlopen'ing a file not in the .nmf

native_client_sdk/src/libraries/nacl_io/mount_node.cc

Index: native_client_sdk/src/libraries/nacl_io/mount_node.cc
diff --git a/native_client_sdk/src/libraries/nacl_io/mount_node.cc b/native_client_sdk/src/libraries/nacl_io/mount_node.cc
index 823a138d682a76831fcecca4b72297f7c258b7ba..83e4e30a33179b6bb2b135c44cd443e12dbdf6f2 100644
--- a/native_client_sdk/src/libraries/nacl_io/mount_node.cc
+++ b/native_client_sdk/src/libraries/nacl_io/mount_node.cc
@@ -80,6 +80,14 @@ int MountNode::Write(size_t offs, const void* buf, size_t count) {
 
 void* MountNode::MMap(void* addr, size_t length, int prot, int flags,
                       size_t offset) {
+  // Never allow mmap'ing PROT_EXEC. The passthrough node supports this, but we
+  // don't. Fortunately, glibc will fallback if this fails, so dlopen will
+  // continue to work.
+  if (prot & PROT_EXEC) {
+    errno = EPERM;
+    return MAP_FAILED;
+  }
+
   // This default mmap support is just enough to make dlopen work.
   // This implementation just reads from the mount into the mmap'd memory area.
   void* new_addr = addr;