Unlike the case of DSOs, we cannot assume that protection boundaries are
page-aligned. In this case, we must take the union of the protections
for the sections sharing a page.
There may also be gaps between sections. For instance, the VNET and
DPCPU sections are allocated separately and do not lie within the linker
file mapping. Such gaps are mapped with VM_PROT_READ.
As for link_elf.c, we initially map the file with VM_PROT_ALL and
downgrade once all relocations are processed.