zlacker

But aren't shellcode style exploits already fairly rare with W^X, so most end up using return-to-libc style attacks? Wouldn't CFI be a much better solution?

>>kracke+(OP)
It's defense in depth. Removing a function like syscall(2) that's a "whatever syscall you want" function that is ostensibly white listed works very well when combined with CFI, and strengthens security of systems without hardware support for CFI.

>>kracke+(OP)
OpenBSD users mostly don’t use systems with strong hardware CFI, so they make do with stuff like this.