0

I am trying to create a systemd service, for a simple script present in a location (other than /usr/local/bin..)

Below script is under /home/vagrant/temp/test.sh

#!/bin/sh

MAX=500
i=0;
while true
do
i=$((i+1));
sleep 2
echo "$i = $(date)"
if [ $i == $MAX ]; then
  exit 0;
fi;
done;
fi

I created simple service named usr-print.service under /etc/systemd/system/. The content of the file is

[Unit]
Description=Simple print service
After=network.target

[Service]

Type=simple
Restart=always
StandardOutput=journal
StandardError=journal

ExecStart=/home/vagrant/temp/test.sh

[Install]
WantedBy=multi-user.target

when i start the service using systemctl daemon-reload; systemctl start usr-print.service i get below exception.

● usr-print.service - Simple print service
   Loaded: loaded (/etc/systemd/system/usr-print.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2021-08-02 06:10:39 UTC; 7s ago
  Process: 1504 ExecStart=/home/vagrant/temp/test.sh (code=exited, status=203/EXEC)
 Main PID: 1504 (code=exited, status=203/EXEC)

Aug 02 06:10:39 localhost.localdomain systemd[1]: usr-print.service: Main process exited, code=exited, status=203/EXEC
Aug 02 06:10:39 localhost.localdomain systemd[1]: usr-print.service: Failed with result 'exit-code'.
Aug 02 06:10:39 localhost.localdomain systemd[1]: usr-print.service: Service RestartSec=100ms expired, scheduling restart.
Aug 02 06:10:39 localhost.localdomain systemd[1]: usr-print.service: Scheduled restart job, restart counter is at 5.
Aug 02 06:10:39 localhost.localdomain systemd[1]: Stopped Simple print service.
Aug 02 06:10:39 localhost.localdomain systemd[1]: usr-print.service: Start request repeated too quickly.
Aug 02 06:10:39 localhost.localdomain systemd[1]: usr-print.service: Failed with result 'exit-code'.
Aug 02 06:10:39 localhost.localdomain systemd[1]: Failed to start Simple print service.

But if I move the script and update the usr-print.service file with ExecStart=/usr/local/bin/test.sh the service starts as expected.

Is there a way to user the /home/vagrant/temp/test.sh path in service file?

Centos 7 - ExecStart=/home/vagrant/temp/test.sh in service file works (shell is running)

Centos/RHEL 8 - ExecStart=/home/vagrant/temp/test.sh in service file DOES NOT work.

Update:

Looks like the SELinux not able to execute that script though it had Execute permissions.

SELinux is preventing /usr/lib/systemd/systemd from execute access on the file /home/vagrant/temp/test.sh.
                                                              
*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd should be allowed execute access on the user-print-service file by default.
    Then you should report this as a bug.
    You can generate a local policy module to allow this access.
    Do allow this access for now by executing:
       # ausearch -c '(-service)' --raw | audit2allow -M my-service
       # semodule -X 300 -i my-service.pp

noticed a ticket related to this in Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1832231

4
  • Is /home a separate filesystem that is mounted noexec, by any chance?
    – Jeff Schaller
    Commented Aug 5, 2021 at 1:14
  • It is not a sperate filesystem. I was using vagrant and virtual box, it was the default user vagrant.
    – Tim
    Commented Aug 5, 2021 at 16:24
  • I just saw the update; allowing a specific execution path is a much better idea than disabling SELinux altogether.
    – Jeff Schaller
    Commented Aug 5, 2021 at 16:30
  • I agree. i was working on a requirement to start a script as systemd service. it worked in centos 7 box not on rhel 8. so explored the documentation. Disabling SELinux in permissive mode is not a good idea.
    – Tim
    Commented Aug 5, 2021 at 16:33

1 Answer 1

-1

One possible apporach,for running in local is to use below

getenforce was enabled enforcing mode on SELinux

sudo setenforce 0 disabled it and put in permissive mode. now the service runs.

But this is not recommended in production env.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .