I want to enable the dynamic core in DOSBox but this is incompatible with SELinux as unconfined_t by default is not allowed to execute from the heap.
The SELinux troubleshooter suggests:
You must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean. setsebool -P selinuxuser_execheap 1
This is a global setting, I believe. I don't want to explicitly allow executing from the heap from any process as this undermines SELinux's security. It also suggests that I could allow execheap for unconfined_t; which is almost as bad.
How do I create a new policy for use with the DOSBox binary that has explicit permission to execute code on the heap?
This is a known-issue with DOSBox but a solution has yet to be implemented in the mainline.
Brownie points for helpful comments on why this is a bad idea for security.