above may only have three privileged access permissions and no user access permissions these may include privileged read only which may be for rodata segment privileged readable and writable which may be for the data segment including kernel address space 1 st and 2 nd level page tables and privileged readable and executable which may be for the text segment in one embodiment there are no allowed writable and executable permissions which can help prevent self modifying code in kernel mode which could be from an lkm in embodiments only the security monitor has access to kernel 1 st and 2 nd level page tables since the page tables are allocated from the security monitor segment therefore change of access permission and physical address is not possible for privileged but non security monitor kernel code or user code in summary in one embodiment of a security monitor there is a special segment in kernel address space having an associated domain e g domain_monitor other than domain_kernel domain_user or domain_io in normal linux mappings the 1 st level and 2 nd level page tables for kernel address space as well as the 1 st level and 2 nd level page tables for user address space may be allocated from the monitor segment all security monitor text and data sections as well as linux init text and data sections may be located in the monitor segment modification of the domain access control register dacr may.