3

I am trying to create a service to run on boot. The service is a program I wrote in C++ and compiled and is located in my users home directory. The program opens some UDP sockets and sits in an infinite loop so it does not exit automatically. I can run the program manually and everything works as expected but when I run systemctl start myservice then check the status I see that it is not running. Error results below + other useful information. FYI the operating system is CentOS Stream.

Output from systemctl status myservice

myservice.service - my serivce
    Loaded: loaded (/etc/systemd/system/myservice.service; disabled; vendor present: disabled)
    Active: failed (Result: exit-code) since <redacted unnecessary timestamp>
    Process 2101 ExecStart=/home/user/program (code=exited, status=203/EXEC)
  Main PID: 2101 (code=exited, status=203/EXEC)

Error Message from journalctl

myservice.service: Main process exited, code=exited, status=203/EXEC
myservice.service: Failed with result 'exit-code'
myservice.service: Service RestartSec=2s expired, scheduling restart

Systemd Unit File

[Unit]
Description=my service
After=network.target

[Service]
Type=simple
ExecStart=/home/user/program
User=user
WorkingDirectory=/home/user/
Restart=always
RestartSec=2
KillMode=process

[Install]
WantedBy=multi-user.target

I understand that the 203 status usually means the file does not exist or does not have proper permissions so below is output to prove it is neither of those issues (hopefully)

Output from ls -laZ /home/user/program

-rwxrwxrwx. 1 root root unconfined_u:object_r:user_home_t:s0 803168 Aug 14 23:35 /home/user/program

Output from sestatus

SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Output from ausearch -ts recent -m avc -i

type=PROCTITLE msg=audit(08/16/2021 20:14:04.216:698) : proctitle=(ster_myservice)
type=SYSCALL msg=audit(08/16/2021 20:14:04.216:698) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x5572ff82e7a0 a1=0x5572ff6ff6d0 a2=0x5572ff7f54b0 a3=0x1 items=0 ppid=1 pid=2568 auid=unset uid=user gid=user euid=user suid=user fsuid=user egid=user sgid=user fsgid=user tty=(none) ses=unset comm=(ster_myservice) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null)
type=AVC msg=audit(08/16/2021 20:14:04.216:698) : avc:  denied  { execute } for  pid=2568 comm=(ster_myservice) name=program dev="dm-2" ino=137 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
4
  • 1
    Which distro are you using? Does the system have SELinux? If so, output both sestatus, ls -laZ /home/user/program and the last lines of ausearch -ts recent -m avc -i just after running systemctl start myservice.service.
    – Edward
    Aug 16, 2021 at 17:15
  • I am using Centos Stream. I will try those commands when I get the chance. Thanks for your response!
    – Owen Kuhn
    Aug 16, 2021 at 20:07
  • @Edward Alright I ran the commands and updated my question
    – Owen Kuhn
    Aug 17, 2021 at 3:21

2 Answers 2

5

SELinux is preventing your program to run: the AVC denial states type=AVC msg=audit(08/16/2021 20:14:04.216:698) : avc: denied { execute } for pid=2568 comm=(ster_myservice) name=program dev="dm-2" ino=137 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0.

This means that systemd, running under the init_t process context, isn't allowed to start your program, labeled as user_home_t.

To mitigate, move your program over to a standard binary directory, such as /usr/local/bin, and then remember to relabel, using restorecon -Rv /usr/local/bin.

Alternatively, if you need your program to run out of your home directory, compile a custom SELinux policy module:

ausearch -m avc -ts recent --comm ster_myservice | audit2allow -a -M ster-myservice
semodule -i ster-myservice.pp
0

In my case, a recent server upgrade change the permissions to the /usr/sbin directory that blocked the mysql user from accessing it.

try:

sudo chmod 755 /usr/sbin

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .