2

After installing the latest version of nexus, currently 3.6.0, I'm able to start it by using the manual command

/opt/nexus/bin/nexus start

but when trying to start as a service (per directions https://help.sonatype.com/display/NXRM3/Installation#Installation-RunningtheService), I get the following:

Oct 04 13:47:53 localhost.localdomain sudo[2546]:     root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/systemctl start nexus.service
Oct 04 13:47:53 localhost.localdomain audit[2546]: USER_CMD pid=2546 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=73797374656D63746C207374617274206E657875732E7365
Oct 04 13:47:53 localhost.localdomain audit[2546]: CRED_REFR pid=2546 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/
Oct 04 13:47:53 localhost.localdomain sudo[2546]: pam_systemd(sudo:session): Cannot create session: Already running in a session
Oct 04 13:47:53 localhost.localdomain audit[2546]: USER_START pid=2546 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_keyini
Oct 04 13:47:53 localhost.localdomain sudo[2546]: pam_unix(sudo:session): session opened for user root by root(uid=0)
Oct 04 13:47:53 localhost.localdomain systemd[1]: Starting nexus service...
-- Subject: Unit nexus.service has begun start-up
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit nexus.service has begun starting up.
Oct 04 13:47:53 localhost.localdomain systemd[2549]: nexus.service: Failed at step EXEC spawning /opt/nexus/bin/nexus: Permission denied
-- Subject: Process /opt/nexus/bin/nexus could not be executed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- The process /opt/nexus/bin/nexus could not be executed and failed.
--
-- The error number returned by this process is 13.
Oct 04 13:47:53 localhost.localdomain audit[2549]: AVC avc:  denied  { execute } for  pid=2549 comm="(nexus)" name="nexus" dev="dm-0" ino=398592 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:adm
Oct 04 13:47:53 localhost.localdomain audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=nexus comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=
Oct 04 13:47:53 localhost.localdomain systemd[1]: nexus.service: Control process exited, code=exited status=203
Oct 04 13:47:53 localhost.localdomain systemd[1]: Failed to start nexus service.
-- Subject: Unit nexus.service has failed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit nexus.service has failed.
--
-- The result is failed.
Oct 04 13:47:53 localhost.localdomain systemd[1]: nexus.service: Unit entered failed state.
Oct 04 13:47:53 localhost.localdomain systemd[1]: nexus.service: Failed with result 'exit-code'.
Oct 04 13:47:53 localhost.localdomain sudo[2546]: pam_unix(sudo:session): session closed for user root
Oct 04 13:47:53 localhost.localdomain audit[2546]: USER_END pid=2546 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_keyinit
Oct 04 13:47:53 localhost.localdomain audit[2546]: CRED_DISP pid=2546 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/
l

UPDATE: I discovered that disabling selinx, i.e. setenforce 0 allows for managing the service, but I don't want to do this as a long term solution.

here are a few lines from /var/log/audit/audit.log

type=AVC msg=audit(1507473817.658:193): avc:  denied  { execute } for  pid=975 comm="(nexus)" name="nexus" dev="dm-0" ino=398592 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
type=SERVICE_START msg=audit(1507473817.660:194): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=nexus comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=AVC msg=audit(1507474250.245:195): avc:  denied  { execute } for  pid=1052 comm="(nexus)" name="nexus" dev="dm-0" ino=398592 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:unconfined_exec_t:s0 tclass=file permissive=0
type=SERVICE_START msg=audit(1507474250.246:196): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=nexus comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'

Any chance someone can help from here?

0

I have to suggest an answer after burning some time on this issue. I had the same issue as cited above. My OS is RHEL 7.5 with SELinux set to enforcing. Nexus version is 3.13.0-01.

The nexus service with systemd was defined as identified by Sonatype. See Sonatype instructions for running a systemd service here: https://help.sonatype.com/repomanager3/installation/run-as-a-service

The service using nexus.service definition from that page starts up but the eventually reaches a timeout and is shutdown. The service type of forking Forking type waits some time for the parent process to exit but it this event apparently does not happen. I didn't contact Sonatype but since this question was not addressed, I am adding a solution that worked. To resolve the issue I changed the type from forking to simple in the nexus.service file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.