Warning. New security RHEL 10 prevent start services from not-standard folders. /opt/.../fbgurad not work as service /usr/bin/.../fbgurad work service as expected

[Sergey Khalyutin]

 RHEL 10 now prevent start services from not-standard folders.

/opt/.../fbgurad not work as service in  RHEL10 but work  in Debian  13
/usr/bin/.../fbgurad  work  service as expected

[Basil A. Sidorov]

05.07.2026 20:37, Sergey Khalyutin пишет:

>  RHEL 10 now prevent start services from not-standard folders.

I have not RedHat subscription, but ...

> /opt/.../fbgurad not work as service in  RHEL10 but work  in Debian  13
> /usr/bin/.../fbgurad  work  service as expected

I check Firebird-5.0.4.1812-0-linux-x64 install script on Oracle Linux
10.1 (last update) and no see problems:

● firebird.service - Firebird Database Server
Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled;
preset: disabled)
Active: active (running) since Mon 2026-07-06 02:06:03 +08; 6min ago
Invocation: 4a81e2e5511a4099a28e2b9be34dc06e
Docs: https://firebirdsql.org/en/firebird-rdbms/
Process: 2356 ExecStart=/opt/firebird/bin/fbguard -daemon -forever
(code=exited, status=0/SUCCESS)
Main PID: 2357 (fbguard)
Tasks: 4 (limit: 12184)
Memory: 31.8M (peak: 41.3M)
CPU: 77ms
CGroup: /system.slice/firebird.service
├─2357 /opt/firebird/bin/fbguard -daemon -forever
└─2358 /opt/firebird/bin/firebird

On my test system I have (install defaults):
sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
--
Basil A. Sidorov <ba...@irk.ru>

[Sergey Khalyutin]

In fact, we discovered this yesterday while debugging our own installer...

rpm -qa | grep release:

=======================
redhat-release-eula-10.2-21.el10.x86_64
redhat-release-10.2-21.el10.x86_64

sestatus
=======================

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

× com-notematrix-sql-engine-5.0.service
     Loaded: loaded (/etc/systemd/system/com-notematrix-sql-engine-5.0.service; enabled; preset: disabled)
     Active: failed (Result: exit-code) since Sun 2026-07-05 11:32:11 EEST; 13s ago
 Invocation: c4ae08c7b9e142fe86aae784c1a4bdd9
    Process: 182036 ExecStart=/opt/com.notematrix/SQL/engine/server-5.0/bin/fbguard -daemon -forever -pidfile /run/com-notematrix-sql-engine-5.0/5DC3F430-D14C-4897-9FA9-E08019AFB125.pid (code=exited, status=20>
   Mem peak: 1.3M
        CPU: 5ms

Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: Starting com-notematrix-sql-engine-5.0.service...
Jul 05 11:32:11 vm-host-s-redhat-work (fbguard)[182036]: com-notematrix-sql-engine-5.0.service: Unable to locate executable '/opt/com.notematrix/SQL/engine/server-5.0/bin/fbguard': Permission denied
Jul 05 11:32:11 vm-host-s-redhat-work (fbguard)[182036]: com-notematrix-sql-engine-5.0.service: Failed at step EXEC spawning /opt/com.notematrix/SQL/engine/server-5.0/bin/fbguard: Permission denied
Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: com-notematrix-sql-engine-5.0.service: Control process exited, code=exited, status=203/EXEC
Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: com-notematrix-sql-engine-5.0.service: Failed with result 'exit-code'.
Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: Failed to start com-notematrix-sql-engine-5.0.service.

[Basil A. Sidorov]

06.07.2026 16:24, Sergey Khalyutin пишет:

> In fact, we discovered this yesterday while debugging our own installer...

Problem still exist with install.sh from "standard" tarball?

[Dimitry Sibiryakov]

Sergey Khalyutin wrote 06.07.2026 10:24:
> Jul 05 11:32:11 vm-host-s-redhat-work (fbguard)[182036]: com-notematrix-sql-
> engine-5.0.service: Unable to locate executable '/opt/com.notematrix/SQL/engine/
> server-5.0/bin/fbguard': Permission denied

Isn't it just a problem with file system ACLs and user, configured in service
file, has no access to the executable?

--
WBR, SD.

[Basil A. Sidorov]

06.07.2026 16:53, 'Dimitry Sibiryakov' via firebird-devel пишет:

No. Systemd has access to executable, but systemd (very) strictly
checked some aspects of programs, running as services.

As expample.
Some modern linux distro has no Java 8 in own repository.
If install f.e. Temurin OpenJDK Java 8, _any_ java application will run
as program and will not run as service with ucnlear "not enough memory"
error.
To enable start java launcher as service - need set on it selinux
context bin_t.

[Sergey Khalyutin]

>>Problem still exist with install.sh from "standard" tarball?

Unfortunately, I was unable to use the standard installer due to "libtommath"...

wget https://github.com/FirebirdSQL/firebird/releases/download/v5.0.4/Firebird-5.0.4.1812-0-linux-x64.tar.gz
==
tar -xvf Firebird-5.0.4.1812-0-linux-x64.tar.gz

Firebird-5.0.4.1812-0-linux-x64/
Firebird-5.0.4.1812-0-linux-x64/install.sh
Firebird-5.0.4.1812-0-linux-x64/buildroot.tar.gz
Firebird-5.0.4.1812-0-linux-x64/manifest.txt
==
cd ~/Firebird-5.0.4.1812-0-linux-x64

sudo ./install.sh

Firebird 5.0.4.1812-0.x64 Installation

Press Enter to start installation or ^C to abort
Please install required library 'tommath' before firebird, after it repeat firebird install


in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo yum install tommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:24:37 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: tommath
Error: Unable to find a match: tommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo yum install libtommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:24:46 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: libtommath
Error: Unable to find a match: libtommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install libtommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:28:32 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: libtommath
Error: Unable to find a match: libtommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install tommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:28:51 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: tommath
Error: Unable to find a match: tommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install tommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:29:15 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: tommath
Error: Unable to find a match: tommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install libtommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:29:22 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: libtommath
Error: Unable to find a match: libtommath


sudo cp -f  /home/in/WORK/source/NOTEMATRIX/CPP/notematrix-core/distr/core/lib/libtommath.so.1 /lib64
sudo cp -f  /home/in/WORK/source/NOTEMATRIX/CPP/notematrix-core/distr/core/lib/libtommath.so.1 /usr/lib
sudo cp -f  /home/in/WORK/source/NOTEMATRIX/CPP/notematrix-core/distr/core/lib/libtommath.so.1 /usr/lib64

in@vm-host-s-redhat-work:~$ sudo ldd /usr/lib64/libtommath.so.1
linux-vdso.so.1 (0x00007f0a9437c000)
libc.so.6 => /lib64/libc.so.6 (0x00007f0a93e27000)
/lib64/ld-linux-x86-64.so.2 (0x00007f0a9437e000)

in@vm-host-s-redhat-work:~$ sudo ldd /lib64/libtommath.so.1
linux-vdso.so.1 (0x00007eff3ec4f000)
libc.so.6 => /lib64/libc.so.6 (0x00007eff3e827000)
/lib64/ld-linux-x86-64.so.2 (0x00007eff3ec51000)


 sudo ./install.sh
[sudo] password for in:

Firebird 5.0.4.1812-0.x64 Installation

Press Enter to start installation or ^C to abort
Please install required library 'tommath' before firebird, after it repeat firebird install
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$

[Dimitry Sibiryakov]

Sergey Khalyutin wrote 06.07.2026 12:37:
> in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo yum install tommath

https://rhel.pkgs.org/10/epel-x86_64/libtommath-1.3.1~rc1-3.el10_0.x86_64.rpm.html

--
WBR, SD.

[Basil A. Sidorov]

06.07.2026 18:37, Sergey Khalyutin пишет:

> Unfortunately, I was unable to use the standard installer due to
> "libtommath"...

dnf install epel-release # if not installed already
dnf makecache # if need
dnf install tar icu libtommath
# create libncurses.so.5 symlink for libncurses.so.6
./install.sh

[Sergey Khalyutin]

wget https://mirror.de.leaseweb.net/epel/10/Everything/x86_64/Packages/l/libtommath-1.3.1~rc1-3.el10_0.x86_64.rpm
sudo yum localinstall /home/in/Firebird-5.0.4.1812-0-linux-x64/libtommath-1.3.1~rc1-3.el10_0.x86_64.rpm

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo ./install.sh

Firebird 5.0.4.1812-0.x64 Installation

Press Enter to start installation or ^C to abort

Extracting install data
Please enter new password for SYSDBA user: masterkey
Fatal error running 'systemctl --quiet start firebird.service' - exiting
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo systemctl status firebird
× firebird.service - Firebird Database Server

     Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled; preset: disabled)

     Active: failed (Result: exit-code) since Mon 2026-07-06 14:08:39 EEST; 4s ago
 Invocation: 87dcc4b27eb1417d812e868e9c8a7ced
       Docs: https://firebirdsql.org/en/firebird-rdbms/
    Process: 615891 ExecStart=/opt/firebird/bin/fbguard -daemon -forever (code=exited, status=203/EXEC)
   Mem peak: 1.2M
        CPU: 3ms

Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Starting firebird.service - Firebird Database Server...
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Unable to locate executable '/opt/firebird/bin/fbguard': Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Failed at step EXEC spawning /opt/firebird/bin/fbguard: Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Control process exited, code=exited, status=203/EXEC
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Failed with result 'exit-code'.
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Failed to start firebird.service - Firebird Database Server.
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$

[Sergey Khalyutin]

SELinux File Contexts -  solution is:

sudo semanage fcontext --add -t bin_t "/opt/...../bin/fbguard?"

sudo restorecon -vRF /opt/...../bin/fbguard

https://linuxcert.guru/blog/?name=semanage-fcontext-restorecon

[Alex Peshkoff]

On 7/8/26 18:44, Sergey Khalyutin wrote:

Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Starting firebird.service - Firebird Database Server...
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Unable to locate executable '/opt/firebird/bin/fbguard': Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Failed at step EXEC spawning /opt/firebird/bin/fbguard: Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Control process exited, code=exited, status=203/EXEC
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Failed with result 'exit-code'.
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Failed to start firebird.service - Firebird Database Server.
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$

1. What will say

ausearch -m AVC -ts today

2. (Just to make sure):

ls -l /opt/firebird/bin

3. Check context

ls -Z /opt/firebird/bin/fbguard

4. Does

setenforce 0

help?

[Alex Peshkoff]

On 7/8/26 18:44, Sergey Khalyutin wrote:

SELinux File Contexts -  solution is:

sudo semanage fcontext --add -t bin_t "/opt/...../bin/fbguard?"

sudo restorecon -vRF /opt/...../bin/fbguard

https://linuxcert.guru/blog/?name=semanage-fcontext-restorecon

Can you provide PR for installer?

[Sergey Khalyutin]

Yes, but I have to debug under Debian 13.3  where  semanage not exists...

       ...

       if [[  "$(semanage --help | grep help)" ]]; then
           semanage fcontext --add -t bin_t \"${1}?\" 2>/dev/null
           restorecon -vRF \"${1}\" 2>/dev/null
      fi

      ...
      systemctl enable "${3}\ 2>/dev/null && systemctl daemon-reload && sleep 1 && systemctl start "${3}"

if there is better way of  <<  if [[  "$(semanage --help | grep help)" ]]; then  >>   to check   "semanage" exists, tell my please...

[Basil A. Sidorov]

09.07.2026 01:48, Sergey Khalyutin пишет:

> Yes, but I have to debug under Debian 13.3  where semanage not exists...

Not installed. Not installed.
In my troubles with selinux on Debian, сhcon will "just enougth".

[Sergey Khalyutin]

>> Not installed.

Of cause :)   not exists "by default"

[Basil A. Sidorov]

05.07.2026 20:37, Sergey Khalyutin пишет:

>  RHEL 10 now prevent start services from not-standard folders.

Add bin_t context (via runcon in ExecStart of unit or chcon for file)?

[Sergey Khalyutin]

>> In my troubles with selinux on Debian, сhcon will "just enougth". 

The "сhcon"  is the best way. I've verified that it's installed by default on RHEL, Debian, Ubuntu, openSUSE, and CentOS. 

Thank you.

https://github.com/FirebirdSQL/firebird/pull/9084