Fix issues with SELinux

[ardovm]

Newer Linux distributions come with SELinux on by default.
Binaries produced by our "official" build VM do not take that into account.

This pull request is against the AOO41X branch because AOO42X and trunk are supposed to be built with more recent compilers, that do not need this additional invocation of execstack.

[DamjanJovanovic]

Why do we need executable stacks? That seems like a bad idea. Is it the main/bridges code that generates executable snippets of machine code?

[ardovm]

I am not sure about what module needs that particular feature.

When running AOO 4.1.16 on systems with SELinux enabled, error messages appear and the audit logs contain entries like the following:

time->Sat Jan 10 18:23:08 2026 type=AVC msg=audit(1768065788.356:276): avc:  denied  { execstack } for  pid=5517 comm="soffice.bin" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0

Please see this thread on dev@.

[ardovm]

I understood that I was trying to solve the wrong problem.
Stacks shall not be executable!
The culprit seems to be the raptor library. This PR now ensures that it is built with noexecstack under Linux.

This PR is supposed to be squashed and merged.

[DamjanJovanovic]

Should we also test for OS="FREEBSD", or use GUI="UNX" instead?

[ardovm]

IIRC FreeBSD has GCC and Clang... does Clang accept -Wl,-z,noexecstack? Otherwise we need to differentiate

[DamjanJovanovic]

Yes, Clang does accept it.