Rei3 and SELINUX on AlmaLinux 8

apaeffgen

I could install REI3 on AlmaLinux 8 with newest patches. I can start it from the terminal server as well.
Starting the service from /opt/REI3 gives an SELINUX error. I tried to attach some new rules, but to no avail.
Has anybody a standard set of rules to apply to get this error fixed?

Rei3: 3.11.2.6000
Alma Linux: 8.10

gabriel

I personally have no experience configuring SELINUX for use with r3. What does the error state?

apaeffgen

Hi Gabriel,

/var/log/messages
Aug 28 12:31:51 localhost systemd[782235]: rei3.service: Failed at step EXEC spawning /opt/REI3/r3: Permission denied
Aug 28 12:31:51 localhost systemd[1]: rei3.service: Main process exited, code=exited, status=203/EXEC
Aug 28 12:31:51 localhost systemd[1]: rei3.service: Failed with result 'exit-code'.

/var/log/audit/audit.log
type=SERVICE_STOP msg=audit(1756377231.492:21141): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rei3 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset"

/opt/REI3 permissions:
drwxrwxr-x. 3 root root system_u:object_r:usr_t:s0 108 23. Aug 19:56 .
drwxrwxrwx. 9 root root system_u:object_r:usr_t:s0 137 26. Aug 14:27 ..
-rwxrwxr-x. 1 root root system_u:object_r:user_home_t:s0 691 23. Aug 19:56 config.json
-rwxrwxr-x. 1 root root system_u:object_r:user_home_t:s0 675 7. Jul 10:13 config_template.json
drwxrwxr-x. 6 root root system_u:object_r:usr_t:s0 67 23. Aug 08:58 data
-rwxrwxr-x. 1 root root system_u:object_r:user_home_t:s0 1,1K 17. Feb 2025 LICENSE
-rwxrwxrwx. 1 root root system_u:object_r:user_home_t:s0 93M 13. Aug 15:23 r3
-rwxrwxr-x. 1 root root system_u:object_r:user_home_t:s0 3,6K 19. Dez 2022 README.txt

Tried to use the audit2allow and audit2why tools to set the right permissions. This did not change the selinux problems.

gabriel

Unfortunately, I cannot see any error that would tell me what is wrong.

I am missing permissions to some sub directories in the permission list (temp, files, transfer) - but besides this, it looks ok.
r3 might want to access some shared resources, like postgres client utilities (if integrated backups are used), GhostScript & ImageMagick (see docs). Maybe this must be enabled as well?

I do not know, whether you need to configure SELINUX to allow access for services to specific ports.

apaeffgen

gabriel
I temporarily made se linux permissive and then it did work. So it seems there is still a permission problem.
I will investigate further