I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at the same time. A bug report is pending there already for ages, and no fix in sight.
There is a boolean variable in SELinux,
allow_execmem, which I could set systemwide, to allow LLVM to run. Though, I'm not in the mood to have such an insecure setting in place.
What I'd like to do is to create either another boolean variable, to run a certain class of programs with this rights set, or to create a file context, which grants the same rights to some executables. Creating a new boolean would probably quite similar to
What I saw is, that there is just a restricted set of permissions, that I can set on a file level:
# ls /sys/fs/selinux/class/file/perms append audit_access create entrypoint execmod execute execute_no_trans getattr ioctl link lock mounton open quotaon read relabelfrom relabelto rename setattr swapon unlink write
So if I see that correctly, simply creating a type and adding permissions for some user, won't work. Is there any straight forward way to do that? How can I create a new boolean like