I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap.

The SELinux troubleshooter suggests:

You must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean.

setsebool -P selinuxuser_execheap 1

This is a global setting, I believe. I don't want to explicitly allow executing from the heap from any process as this undermines SELinux's security. It also suggests that I could allow execheap for unconfined_t; which is almost as bad.

How do I create a new policy for use with the DOSBox binary that has explicit permission to execute code on the heap?

This is a known-issue with DOSBox but a solution has yet to be implemented in the mainline.

Brownie points for helpful comments on why this is a bad idea for security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.