We can run executable files that are only given read but not execute access by copying them into a memfd and then call fexecve on the file descriptor. Should we restrict this?