Is RWX Required?

[sempervictus]

Grsec/PaX systems implement MPROTECT which prevents WX and W->X runtime memory use. Candle-vllm trips this protection:

[69829.811136] [ T206695] grsec: denied RWX mprotect of /usr/lib/libc.so.6 by /usr/ocal/bin/candle-vllm[candle-vllm:206695] uid/euid:1001/1001 gid/egid:1006/1006, parent /usr/bin/bash[bash:3763] uid/euid:1001/1001 gid/egid:1006/1006

with some more detailed warnings in the candle-vllm output:

$ candle-vllm --p 12099  --m unsloth/Devstral-Small-2507-GGUF --f Devstral-Small-2507-Q3_K_M.gguf
[1758074512.549163] [unknown:455575:0]           bistro.c:45   UCX  ERROR Failed to change page protection: Permission denied
[1758074512.549170] [unknown:455575:0]          install.c:402  UCX  WARN failed to install bistro hook for 'mmap'
2025-09-17T02:01:52.554888Z  INFO candle_vllm::openai::pipelines::pipeline: Downloading GGUF file Devstral-Small-2507-Q3_K_M.gguf from repo unsloth/Devstral-Small-2507-GGUF