mjhjmtu

I'm trying to start a service to sign the VirtualBox kernel modules, following https://nidomiro.de/2018/04/automatic-virtualbox-module-signing-for-uefi/

After adjusting the paths referenced in the bash script for Fedora, the script works when run manually as root. However, the service always fails:

$ systemctl status sign-virtualbox.service 
● sign-virtualbox.service - Signing VirtualBox Kernel Modules for UEFI
 Loaded: loaded (/etc/systemd/system/sign-virtualbox.service; enabled; vendor preset: disabled)
 Active: failed (Result: exit-code)
 Process: 3018 ExecStart=/root/module-signing/sign-vbox-modules.sh (code=exited, status=203/EXEC)
 Main PID: 3018 (code=exited, status=203/EXEC)

The output of sudo journalctl -xe says sign-virtualbox.service: Failed at step EXEC spawning /root/module-signing/sign-vbox-modules.sh: Permission denied

File permissions:

$ sudo ls -l /root/module-signing/sign-vbox-modules.sh
-rwx------. 1 root root 309 Aug 7 11:35 /root/module-signing/sign-vbox-modules.sh

Since the service is started as root, there shouldn't be a permissions issue, should there?

Execution of the binary is probably being blocked by SELinux. You can confirm that from the journal logs or perhaps from the audit logs (in /var/log/audit/audit.log) searching for "avc" errors.

To solve this problem, I'd recommend you host this script from a directory where scripts and binaries are typically located, such as /usr/local/bin, instead of under the home directory of the root user.

Once you move this script there, run restorecon on it to get it to the proper SELinux type (which should be system_u:object_r:bin_t:s0 or similar.)

So:

mv /root/module-signing/sign-vbox-modules.sh /usr/local/bin/
restorecon /usr/local/bin/sign-vbox-modules.sh

And edit your systemd service file to update the path.

And if you want to inspect that it has an appropriate SELinux type:

ls -lZ /usr/local/bin/sign-vbox-modules.sh