Warning. New security RHEL 10 prevent start services from not-standard folders. /opt/.../fbgurad not work as service /usr/bin/.../fbgurad work service as expected

[Sergey Khalyutin]

 RHEL 10 now prevent start services from not-standard folders.

/opt/.../fbgurad not work as service in  RHEL10 but work  in Debian  13
/usr/bin/.../fbgurad  work  service as expected

[Basil A. Sidorov]

05.07.2026 20:37, Sergey Khalyutin пишет:

>  RHEL 10 now prevent start services from not-standard folders.

I have not RedHat subscription, but ...

> /opt/.../fbgurad not work as service in  RHEL10 but work  in Debian  13
> /usr/bin/.../fbgurad  work  service as expected

I check Firebird-5.0.4.1812-0-linux-x64 install script on Oracle Linux
10.1 (last update) and no see problems:

● firebird.service - Firebird Database Server
Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled;
preset: disabled)
Active: active (running) since Mon 2026-07-06 02:06:03 +08; 6min ago
Invocation: 4a81e2e5511a4099a28e2b9be34dc06e
Docs: https://firebirdsql.org/en/firebird-rdbms/
Process: 2356 ExecStart=/opt/firebird/bin/fbguard -daemon -forever
(code=exited, status=0/SUCCESS)
Main PID: 2357 (fbguard)
Tasks: 4 (limit: 12184)
Memory: 31.8M (peak: 41.3M)
CPU: 77ms
CGroup: /system.slice/firebird.service
├─2357 /opt/firebird/bin/fbguard -daemon -forever
└─2358 /opt/firebird/bin/firebird

On my test system I have (install defaults):
sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
--
Basil A. Sidorov <ba...@irk.ru>

[Sergey Khalyutin]

In fact, we discovered this yesterday while debugging our own installer...

rpm -qa | grep release:

=======================
redhat-release-eula-10.2-21.el10.x86_64
redhat-release-10.2-21.el10.x86_64

sestatus
=======================

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

× com-notematrix-sql-engine-5.0.service
     Loaded: loaded (/etc/systemd/system/com-notematrix-sql-engine-5.0.service; enabled; preset: disabled)
     Active: failed (Result: exit-code) since Sun 2026-07-05 11:32:11 EEST; 13s ago
 Invocation: c4ae08c7b9e142fe86aae784c1a4bdd9
    Process: 182036 ExecStart=/opt/com.notematrix/SQL/engine/server-5.0/bin/fbguard -daemon -forever -pidfile /run/com-notematrix-sql-engine-5.0/5DC3F430-D14C-4897-9FA9-E08019AFB125.pid (code=exited, status=20>
   Mem peak: 1.3M
        CPU: 5ms

Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: Starting com-notematrix-sql-engine-5.0.service...
Jul 05 11:32:11 vm-host-s-redhat-work (fbguard)[182036]: com-notematrix-sql-engine-5.0.service: Unable to locate executable '/opt/com.notematrix/SQL/engine/server-5.0/bin/fbguard': Permission denied
Jul 05 11:32:11 vm-host-s-redhat-work (fbguard)[182036]: com-notematrix-sql-engine-5.0.service: Failed at step EXEC spawning /opt/com.notematrix/SQL/engine/server-5.0/bin/fbguard: Permission denied
Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: com-notematrix-sql-engine-5.0.service: Control process exited, code=exited, status=203/EXEC
Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: com-notematrix-sql-engine-5.0.service: Failed with result 'exit-code'.
Jul 05 11:32:11 vm-host-s-redhat-work systemd[1]: Failed to start com-notematrix-sql-engine-5.0.service.

[Basil A. Sidorov]

06.07.2026 16:24, Sergey Khalyutin пишет:

> In fact, we discovered this yesterday while debugging our own installer...

Problem still exist with install.sh from "standard" tarball?

[Dimitry Sibiryakov]

Sergey Khalyutin wrote 06.07.2026 10:24:
> Jul 05 11:32:11 vm-host-s-redhat-work (fbguard)[182036]: com-notematrix-sql-
> engine-5.0.service: Unable to locate executable '/opt/com.notematrix/SQL/engine/
> server-5.0/bin/fbguard': Permission denied

Isn't it just a problem with file system ACLs and user, configured in service
file, has no access to the executable?

--
WBR, SD.

[Basil A. Sidorov]

06.07.2026 16:53, 'Dimitry Sibiryakov' via firebird-devel пишет:

No. Systemd has access to executable, but systemd (very) strictly
checked some aspects of programs, running as services.

As expample.
Some modern linux distro has no Java 8 in own repository.
If install f.e. Temurin OpenJDK Java 8, _any_ java application will run
as program and will not run as service with ucnlear "not enough memory"
error.
To enable start java launcher as service - need set on it selinux
context bin_t.

[Sergey Khalyutin]

>>Problem still exist with install.sh from "standard" tarball?

Unfortunately, I was unable to use the standard installer due to "libtommath"...

wget https://github.com/FirebirdSQL/firebird/releases/download/v5.0.4/Firebird-5.0.4.1812-0-linux-x64.tar.gz
==
tar -xvf Firebird-5.0.4.1812-0-linux-x64.tar.gz

Firebird-5.0.4.1812-0-linux-x64/
Firebird-5.0.4.1812-0-linux-x64/install.sh
Firebird-5.0.4.1812-0-linux-x64/buildroot.tar.gz
Firebird-5.0.4.1812-0-linux-x64/manifest.txt
==
cd ~/Firebird-5.0.4.1812-0-linux-x64

sudo ./install.sh

Firebird 5.0.4.1812-0.x64 Installation

Press Enter to start installation or ^C to abort
Please install required library 'tommath' before firebird, after it repeat firebird install


in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo yum install tommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:24:37 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: tommath
Error: Unable to find a match: tommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo yum install libtommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:24:46 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: libtommath
Error: Unable to find a match: libtommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install libtommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:28:32 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: libtommath
Error: Unable to find a match: libtommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install tommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:28:51 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: tommath
Error: Unable to find a match: tommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install tommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:29:15 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: tommath
Error: Unable to find a match: tommath

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo dnf install libtommath
Updating Subscription Management repositories.
Last metadata expiration check: 0:29:22 ago on Mon 06 Jul 2026 12:07:14 PM EEST.
No match for argument: libtommath
Error: Unable to find a match: libtommath


sudo cp -f  /home/in/WORK/source/NOTEMATRIX/CPP/notematrix-core/distr/core/lib/libtommath.so.1 /lib64
sudo cp -f  /home/in/WORK/source/NOTEMATRIX/CPP/notematrix-core/distr/core/lib/libtommath.so.1 /usr/lib
sudo cp -f  /home/in/WORK/source/NOTEMATRIX/CPP/notematrix-core/distr/core/lib/libtommath.so.1 /usr/lib64

in@vm-host-s-redhat-work:~$ sudo ldd /usr/lib64/libtommath.so.1
linux-vdso.so.1 (0x00007f0a9437c000)
libc.so.6 => /lib64/libc.so.6 (0x00007f0a93e27000)
/lib64/ld-linux-x86-64.so.2 (0x00007f0a9437e000)

in@vm-host-s-redhat-work:~$ sudo ldd /lib64/libtommath.so.1
linux-vdso.so.1 (0x00007eff3ec4f000)
libc.so.6 => /lib64/libc.so.6 (0x00007eff3e827000)
/lib64/ld-linux-x86-64.so.2 (0x00007eff3ec51000)


 sudo ./install.sh
[sudo] password for in:

Firebird 5.0.4.1812-0.x64 Installation

Press Enter to start installation or ^C to abort
Please install required library 'tommath' before firebird, after it repeat firebird install
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$

[Dimitry Sibiryakov]

Sergey Khalyutin wrote 06.07.2026 12:37:
> in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo yum install tommath

https://rhel.pkgs.org/10/epel-x86_64/libtommath-1.3.1~rc1-3.el10_0.x86_64.rpm.html

--
WBR, SD.

[Basil A. Sidorov]

06.07.2026 18:37, Sergey Khalyutin пишет:

> Unfortunately, I was unable to use the standard installer due to
> "libtommath"...

dnf install epel-release # if not installed already
dnf makecache # if need
dnf install tar icu libtommath
# create libncurses.so.5 symlink for libncurses.so.6
./install.sh

[Sergey Khalyutin]

wget https://mirror.de.leaseweb.net/epel/10/Everything/x86_64/Packages/l/libtommath-1.3.1~rc1-3.el10_0.x86_64.rpm
sudo yum localinstall /home/in/Firebird-5.0.4.1812-0-linux-x64/libtommath-1.3.1~rc1-3.el10_0.x86_64.rpm

in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo ./install.sh

Firebird 5.0.4.1812-0.x64 Installation

Press Enter to start installation or ^C to abort

Extracting install data
Please enter new password for SYSDBA user: masterkey
Fatal error running 'systemctl --quiet start firebird.service' - exiting
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$ sudo systemctl status firebird
× firebird.service - Firebird Database Server

     Loaded: loaded (/usr/lib/systemd/system/firebird.service; enabled; preset: disabled)

     Active: failed (Result: exit-code) since Mon 2026-07-06 14:08:39 EEST; 4s ago
 Invocation: 87dcc4b27eb1417d812e868e9c8a7ced
       Docs: https://firebirdsql.org/en/firebird-rdbms/
    Process: 615891 ExecStart=/opt/firebird/bin/fbguard -daemon -forever (code=exited, status=203/EXEC)
   Mem peak: 1.2M
        CPU: 3ms

Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Starting firebird.service - Firebird Database Server...
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Unable to locate executable '/opt/firebird/bin/fbguard': Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work (fbguard)[615891]: firebird.service: Failed at step EXEC spawning /opt/firebird/bin/fbguard: Permission denied
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Control process exited, code=exited, status=203/EXEC
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: firebird.service: Failed with result 'exit-code'.
Jul 06 14:08:39 vm-host-s-redhat-work systemd[1]: Failed to start firebird.service - Firebird Database Server.
in@vm-host-s-redhat-work:~/Firebird-5.0.4.1812-0-linux-x64$