1

I'm trying to get numba running on my Debian server in SELinux enforcing mode. Numba is build on LLVMs jit compiler. The problem is, LLVM insists on having memory, which is writeable and executable at the same time. A bug report is pending there already for ages, and no fix in sight.

There is a boolean variable in SELinux, allow_execmem, which I could set systemwide, to allow LLVM to run. Though, I'm not in the mood to have such an insecure setting in place.

What I'd like to do is to create either another boolean variable, to run a certain class of programs with this rights set, or to create a file context, which grants the same rights to some executables. Creating a new boolean would probably quite similar to httpd_execmem.

What I saw is, that there is just a restricted set of permissions, that I can set on a file level:

# ls /sys/fs/selinux/class/file/perms
append  audit_access  create  entrypoint  execmod  execute 
execute_no_trans  getattr  ioctl  link  lock  mounton  open  
quotaon  read  relabelfrom  relabelto  rename  setattr  swapon  
unlink  write

So if I see that correctly, simply creating a type and adding permissions for some user, won't work. Is there any straight forward way to do that? How can I create a new boolean like httpd_execmem?

0

What seemd to work out was creating an own module with smth like this:

module llvm 1.0;

require {
        class process { execmem };
};
type llvm_t;    
allow llvm_t self:process execmem;

Unfortunately it turned out, that I couldn't set any type on files within my home directory, as they were contained within an ecryptfs mount. So I ended up allowing the whole unconfined domain with execmem. This is more permissive than what I had hoped for, but still much better than allowing all processes on the system execmem.

module llvm 1.0;

require {
        type unconfined_t;
        class process { execmem };
};
allow unconfined_t self:process execmem;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.