SElinux modification required for mango bin/ scripts

[cbyrne]

Just something I noticed while doing a new test install of v4.

If SElinux is enabled, the bash scripts in the mango bin directory need a small modification to their type otherwise mango.service will fail with

mango.service: Failed at step EXEC spawning /opt/mango/bin/start-mango.sh: Permission denied

To check a file's SElinux type, pass the -Z flag to ls.

ls -Z /opt/mango/bin/
unconfined_u:object_r:user_home_t:s0 certbot-deploy.sh*  
unconfined_u:object_r:user_home_t:s0 mango.cmd
unconfined_u:object_r:user_home_t:s0 start-options.sh*
unconfined_u:object_r:user_home_t:s0 genkey.sh*
unconfined_u:object_r:user_home_t:s0 mango.service
unconfined_u:object_r:user_home_t:s0 stop-mango.sh*
unconfined_u:object_r:user_home_t:s0 getenv.sh*
unconfined_u:object_r:user_home_t:s0 mango.xml
unconfined_u:object_r:user_home_t:s0 install-mango.sh*
unconfined_u:object_r:user_home_t:s0 start-mango.sh*

In order to be run from a systemd service, the scripts need to be of type bin_t. Their type can be changed using chcon.

sudo chcon -t bin_t /opt/mango/bin/*.sh

Now the files are of the correct SElinux type and mango.service will run as expected.

ls -Z /opt/mango/bin/
unconfined_u:object_r:bin_t:s0 certbot-deploy.sh*
unconfined_u:object_r:user_home_t:s0 mango.cmd
unconfined_u:object_r:bin_t:s0 start-options.sh*
unconfined_u:object_r:bin_t:s0 genkey.sh*
unconfined_u:object_r:user_home_t:s0 mango.service
unconfined_u:object_r:bin_t:s0 stop-mango.sh*
unconfined_u:object_r:bin_t:s0 getenv.sh*
unconfined_u:object_r:user_home_t:s0 mango.xml
unconfined_u:object_r:bin_t:s0 install-mango.sh*
unconfined_u:object_r:bin_t:s0 start-mango.sh*

Might be helpful info to add to the linux documentation.