Ensure ExecShield (NX/no-execute memory protection) is enabled

# A processor without the nx flag → ExecShield unavailable.
if grep '^flags' /proc/cpuinfo 2>/dev/null | grep -qvE '([^[:alnum:]])nx([^[:alnum:]]|$)'; then
  echo "FAIL: one or more processors do not expose the nx (ExecShield) flag"
  exit 1
fi
# A noexec kernel argument disables NX.
if grubby --info=ALL 2>/dev/null | grep '^args' | grep -qE '([^[:alnum:]])noexec([^[:alnum:]]|$)'; then
  echo "FAIL: a 'noexec' kernel argument is disabling NX/ExecShield"
  exit 1
fi
echo "OK: ExecShield/NX is enabled on all processors and not disabled by a kernel argument"
exit 0

expected_exit:

0

note:

ExecShield/NX is enabled by default on RHEL 10. If a processor lacks the nx flag, enable "Execute Disable Bit" / "NX" in the system firmware (BIOS/UEFI). If a "noexec" kernel argument is present, remove it from the boot loader configuration (e.g. via grubby --update-kernel=ALL --remove-args="noexec") and reboot.