Skip to content

Adjust SELinux context for fbguard - #9084

Open
Khalyutin wants to merge 6 commits into
FirebirdSQL:masterfrom
notesoft:work-install.sh
Open

Adjust SELinux context for fbguard#9084
Khalyutin wants to merge 6 commits into
FirebirdSQL:masterfrom
notesoft:work-install.sh

Conversation

@Khalyutin

@Khalyutin Khalyutin commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Porblem:

RHEL 10 now prevent start services from not-standard folders.

: firebird.service: Unable to locate executable '/opt/firebird/bin/fbguard': Permission denied
: firebird.service: Failed at step EXEC spawning /opt/firebird/bin/fbguard: Permission denied

/opt/.../fbgurad not work as service in RHEL10 but work in Debian 13
/usr/bin/.../fbgurad work service as expected

https://groups.google.com/g/firebird-devel/c/-7DmsSesg3E


in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo ./install.sh

Firebird 5.0.4.1812-0.x64 Installation
Press Enter to start installation or ^C to abort
Extracting install data
Please enter new password for SYSDBA user: masterkey
Fatal error running 'systemctl --quiet start firebird.service' - exiting
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo systemctl status firebird
× firebird.service - Firebird Database Server

     Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled; preset: disabled)
     Active: failed (Result: exit-code) since Mon 2026-07-06 14:08:39 EEST; 4s ago
 Invocation: 87dcc4b27eb1417d812e868e9c8a7ced
       Docs: https://firebirdsql.org/en/firebird-rdbms/
    Process: 615891 ExecStart=/opt/firebird/bin/fbguard -daemon -forever (code=exited, status=203/EXEC)
   Mem peak: 1.2M
        CPU: 3ms

Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Starting firebird.service - Firebird Database Server...
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Unable to locate executable '/opt/firebird/bin/fbguard': Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Failed at step EXEC spawning /opt/firebird/bin/fbguard: Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Control process exited, code=exited, status=203/EXEC
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Failed with result 'exit-code'.
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Failed to start firebird.service - Firebird Database Server.
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$

Solution:

Add bin_t context to fbguard via chcon in install.sh

Test:
https://github.com/notesoft/SQLfb/tree/work-install.sh
Artifact download URL: https://github.com/notesoft/SQLfb/actions/runs/29092950440/artifacts/8227790862


Installed:
  libtomcrypt-1.18.2-21.el10_1.x86_64                                                                                                                                                                                    

Complete!
in@vm-host-s-redhat-work:~/Firebird-6.0.0.2070-Initial-linux-x64$ sudo ./install.sh

Firebird 6.0.0.2070-Initial.x64 Installation

Press Enter to start installation or ^C to abort
Extracting install data
Please enter new password for SYSDBA user: masterkey
/opt/firebird/bin/gsec: symbol lookup error: /opt/firebird/plugins/libSrp.so: undefined symbol: mp_ubin_size

Install completed
in@vm-host-s-redhat-work:~/Firebird-6.0.0.2070-Initial-linux-x64$ sudo systemctl status firebird
● firebird.service - Firebird Database Server
     Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled; preset: disabled)
     Active: active (running) since Sat 2026-07-11 10:03:32 EEST; 49s ago
 Invocation: 51da2a4a944d45479aee50ac30f42785
       Docs: https://firebirdsql.org/en/firebird-rdbms/
    Process: 1652545 ExecStart=/opt/firebird/bin/fbguard -daemon -forever (code=exited, status=0/SUCCESS)
   Main PID: 1652546 (fbguard)
      Tasks: 5 (limit: 22908)
     Memory: 15.7M (peak: 16M)
        CPU: 47ms
     CGroup: /system.slice/firebird.service
             ├─1652546 /opt/firebird/bin/fbguard -daemon -forever
             └─1652547 /opt/firebird/bin/firebird

Jul 11 10:03:32 vm-host-s-redhat-work systemd[1]: Starting firebird.service - Firebird Database Server...
Jul 11 10:03:32 vm-host-s-redhat-work systemd[1]: Started firebird.service - Firebird Database Server.
in@vm-host-s-redhat-work:~/Firebird-6.0.0.2070-Initial-linux-x64$

@AlexPeshkoff

AlexPeshkoff commented Jul 25, 2026

Copy link
Copy Markdown
Member

I see 2 problems with suggested changes.

Install script will produce an error like:
bash: chcon: command not found
on systems without selinux support. Not good. Check for command presence is needed.

Changes done by chcon are temporary - if/when restorecon is used or a full filesystem relabel done changes made by chcon will be wiped out. May be better use semanage + restorecon ?

@Khalyutin
Khalyutin marked this pull request as draft July 30, 2026 14:07
AlexPeshkoff
AlexPeshkoff reviewed Jul 30, 2026
View reviewed changes
Comment thread builds/install/posix-common/posixLibrary.sh.in Outdated
for FileName in fbguard
do
# check need fcontext
if [[ $(ls -Z / | grep usr | grep system_u:) ]]; then

@AlexPeshkoff AlexPeshkoff Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you avoid use of bash extensions like '[['? We use /bin/sh to run install scripts cause bash may be not installed by default on some distros.

AlexPeshkoff
AlexPeshkoff reviewed Jul 30, 2026
View reviewed changes
Comment thread builds/install/posix-common/posixLibrary.sh.in Outdated
else

echo "!!! SELinux context error: $(ls -Z ${fb_install_prefix}/bin/$FileName)"
echo "!!! Please install 'semanage' and 'restorecon' from 'policycoreutils-python(-utils)' and reinstall firebird \n for '$FileName' may be run as service."

@AlexPeshkoff AlexPeshkoff Jul 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Package can be named differently on different distro, mentioning what utilities are missing should be enough.

@Khalyutin

Khalyutin commented Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Artifact download URL: https://github.com/FirebirdSQL/firebird/actions/runs/30560791681/artifacts/8767096179

Install completed
khalyutin@vm-host-s-redhat-work:~/Firebird-6.0.0.2101-Initial-linux-x64$ sudo systemctl status firebird
● firebird.service - Firebird Database Server
Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled; preset: disabled)
Active: active (running) since Thu 2026-07-30 19:40:48 EEST; 5s ago
.

@Khalyutin
Khalyutin marked this pull request as ready for review July 30, 2026 16:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AlexPeshkoff AlexPeshkoff AlexPeshkoff left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Khalyutin @AlexPeshkoff