1

I'm trying to start a service to sign the VirtualBox kernel modules, following https://nidomiro.de/2018/04/automatic-virtualbox-module-signing-for-uefi/

After adjusting the paths referenced in the bash script for Fedora, the script works when run manually as root. However, the service always fails:

$ systemctl status sign-virtualbox.service 
● sign-virtualbox.service - Signing VirtualBox Kernel Modules for UEFI
   Loaded: loaded (/etc/systemd/system/sign-virtualbox.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code)
  Process: 3018 ExecStart=/root/module-signing/sign-vbox-modules.sh (code=exited, status=203/EXEC)
 Main PID: 3018 (code=exited, status=203/EXEC)

The output of sudo journalctl -xe says sign-virtualbox.service: Failed at step EXEC spawning /root/module-signing/sign-vbox-modules.sh: Permission denied

File permissions:

$ sudo ls -l /root/module-signing/sign-vbox-modules.sh
-rwx------. 1 root root 309 Aug  7 11:35 /root/module-signing/sign-vbox-modules.sh

Since the service is started as root, there shouldn't be a permissions issue, should there?

  • When you realize why this duplicates unix.stackexchange.com/questions/208736 , you will know what to do. (-: – JdeBP Aug 7 '18 at 16:10
  • @JdeBP How do I determine the correct SELinux context to assign to the files? The answer to the question to which you linked doesn't really answer the question beyond "SELinux contexts exist, get yours right" – zaen Aug 7 '18 at 19:03
0

Execution of the binary is probably being blocked by SELinux. You can confirm that from the journal logs or perhaps from the audit logs (in /var/log/audit/audit.log) searching for "avc" errors.

To solve this problem, I'd recommend you host this script from a directory where scripts and binaries are typically located, such as /usr/local/bin, instead of under the home directory of the root user.

Once you move this script there, run restorecon on it to get it to the proper SELinux type (which should be system_u:object_r:bin_t:s0 or similar.)

So:

mv /root/module-signing/sign-vbox-modules.sh /usr/local/bin/
restorecon /usr/local/bin/sign-vbox-modules.sh

And edit your systemd service file to update the path.

And if you want to inspect that it has an appropriate SELinux type:

ls -lZ /usr/local/bin/sign-vbox-modules.sh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.