Function Signature

#include <sys/mman.h>

int mprotect(void *addr, size_t len, int prot);

/* Returns: 0 on success, -1 on error (errno set) */

Protection Flags (prot)

These flags can be combined with bitwise OR: for example, PROT_READ | PROT_WRITE makes a region both readable and writable. If a process violates the protection (e.g., writes to a read-only page), the kernel delivers SIGSEGV (segmentation fault).

How the MMU Enforces Protection

Important Rules

Example 1: Make a Region Read-Only Then Write to It

This example shows what happens when you violate memory protection — the classic way to learn SIGSEGV:

#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#include <unistd.h>

int main(void)
{
    long pagesize = sysconf(_SC_PAGESIZE);

    /* Allocate one page of memory using mmap */
    char *buf = mmap(NULL, pagesize,
                     PROT_READ | PROT_WRITE,
                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (buf == MAP_FAILED) {
        perror("mmap");
        exit(EXIT_FAILURE);
    }

    /* Write some data while it's writable */
    strcpy(buf, "Hello, Virtual Memory!");
    printf("Before mprotect: %s\n", buf);

    /* Now make the region READ-ONLY */
    if (mprotect(buf, pagesize, PROT_READ) == -1) {
        perror("mprotect");
        exit(EXIT_FAILURE);
    }

    /* This read is fine */
    printf("After mprotect (read): %s\n", buf);

    /* This WRITE will cause SIGSEGV! */
    /* buf[0] = 'X';   <-- uncomment to see the crash */

    munmap(buf, pagesize);
    return 0;
}

Example 2: JIT Compiler Pattern – Write Code, Then Execute It

JIT (Just-In-Time) compilers generate machine code at runtime. They need to write bytes first (WRITE permission), then switch the region to executable (EXEC permission). This is a classic W^X (Write XOR Execute) security pattern.

#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#include <unistd.h>

int main(void)
{
    long pagesize = sysconf(_SC_PAGESIZE);

    /*
     * Step 1: Allocate page with WRITE permission to write machine code.
     * Note: We do NOT give EXEC yet (W^X principle).
     */
    unsigned char *code = mmap(NULL, pagesize,
                                PROT_READ | PROT_WRITE,
                                MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (code == MAP_FAILED) {
        perror("mmap");
        exit(EXIT_FAILURE);
    }

    /*
     * Step 2: Write a simple x86-64 function that returns 42.
     *   mov eax, 42    (B8 2A 00 00 00)
     *   ret            (C3)
     */
    unsigned char machine_code[] = {
        0xB8, 0x2A, 0x00, 0x00, 0x00,  /* mov eax, 42 */
        0xC3                            /* ret         */
    };
    memcpy(code, machine_code, sizeof(machine_code));

    /*
     * Step 3: Remove WRITE, add EXEC.
     * This is the W^X switch — never have both W and X at the same time.
     */
    if (mprotect(code, pagesize, PROT_READ | PROT_EXEC) == -1) {
        perror("mprotect (EXEC)");
        exit(EXIT_FAILURE);
    }

    /* Step 4: Call the generated code as a function */
    int (*func)(void) = (int (*)(void)) code;
    int result = func();
    printf("JIT function returned: %d\n", result);  /* Prints: 42 */

    munmap(code, pagesize);
    return 0;
}

Example 3: Catching Protection Violations with a Signal Handler

Instead of crashing, you can install a SIGSEGV handler to react gracefully when a protection violation occurs. This is used in advanced techniques like read barriers in garbage collectors.

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/mman.h>
#include <setjmp.h>
#include <unistd.h>

static sigjmp_buf jump_buffer;

/* Signal handler for SIGSEGV */
static void segv_handler(int signum)
{
    printf("Caught SIGSEGV (signal %d) – protection violation!\n", signum);
    siglongjmp(jump_buffer, 1);  /* Jump back to safe point */
}

int main(void)
{
    long pagesize = sysconf(_SC_PAGESIZE);

    /* Install SIGSEGV handler */
    struct sigaction sa;
    sa.sa_handler = segv_handler;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_RESETHAND;  /* Reset to default after first signal */
    sigaction(SIGSEGV, &sa, NULL);

    /* Map a page */
    char *buf = mmap(NULL, pagesize,
                     PROT_READ | PROT_WRITE,
                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (buf == MAP_FAILED) { perror("mmap"); exit(1); }

    /* Make it read-only */
    mprotect(buf, pagesize, PROT_READ);

    /* Set safe return point */
    if (sigsetjmp(jump_buffer, 1) == 0) {
        printf("Attempting write to read-only page...\n");
        buf[0] = 'X';  /* This will trigger SIGSEGV */
    } else {
        printf("Recovered from violation. Program continues.\n");
    }

    munmap(buf, pagesize);
    return 0;
}

Example 4: Guard Pages for Buffer Overflow Detection

Guard pages are a classic use of PROT_NONE. Place an inaccessible page just after a buffer. Any overflow will immediately fault instead of silently corrupting memory.

#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#include <unistd.h>

int main(void)
{
    long pagesize = sysconf(_SC_PAGESIZE);

    /*
     * Allocate 2 pages:
     *   Page 0: actual buffer (PROT_READ | PROT_WRITE)
     *   Page 1: guard page    (PROT_NONE — no access allowed)
     */
    char *region = mmap(NULL, 2 * pagesize,
                        PROT_READ | PROT_WRITE,
                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (region == MAP_FAILED) { perror("mmap"); exit(1); }

    char *buffer    = region;               /* Page 0 – usable buffer */
    char *guardpage = region + pagesize;    /* Page 1 – inaccessible  */

    /* Make the guard page completely inaccessible */
    if (mprotect(guardpage, pagesize, PROT_NONE) == -1) {
        perror("mprotect guard");
        exit(1);
    }

    printf("Buffer at: %p\n", buffer);
    printf("Guard  at: %p\n", guardpage);

    /* Normal write – fine */
    memset(buffer, 'A', 10);
    printf("Wrote 10 bytes to buffer: OK\n");

    /* Overflow past the buffer into the guard page → SIGSEGV */
    /* memset(buffer, 'A', pagesize + 1); */
    /* Uncomment above to see immediate crash instead of silent corruption */

    munmap(region, 2 * pagesize);
    return 0;
}

Common Errors

Interview Questions & Answers