diff --git a/resources/self_hosting/deployment/aws.mdx b/resources/self_hosting/deployment/aws.mdx index a7814c461..ac7180989 100644 --- a/resources/self_hosting/deployment/aws.mdx +++ b/resources/self_hosting/deployment/aws.mdx @@ -52,6 +52,30 @@ Move the binary file into `/usr/local/bin` to make it accessible from anywhere: sudo mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Amazon Linux, Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +sudo restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + ## Step 2: Create system user Running applications as root exposes you to unnecessary security risks. Create a dedicated user for Meilisearch: diff --git a/resources/self_hosting/deployment/digitalocean.mdx b/resources/self_hosting/deployment/digitalocean.mdx index 41b91328b..bc3631c77 100644 --- a/resources/self_hosting/deployment/digitalocean.mdx +++ b/resources/self_hosting/deployment/digitalocean.mdx @@ -45,6 +45,30 @@ Next, you need to make the binary accessible from anywhere in your system. Move mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +sudo restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + Meilisearch is now installed in your system, but it is not publicly accessible. ## Step 2: Create system user diff --git a/resources/self_hosting/deployment/gcp.mdx b/resources/self_hosting/deployment/gcp.mdx index 140cdecb4..a6baf9964 100644 --- a/resources/self_hosting/deployment/gcp.mdx +++ b/resources/self_hosting/deployment/gcp.mdx @@ -42,6 +42,30 @@ Move the binary to make it accessible system-wide: sudo mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +sudo restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + ## Step 2: Create system user Create a dedicated user for running Meilisearch: diff --git a/resources/self_hosting/deployment/running_production.mdx b/resources/self_hosting/deployment/running_production.mdx index 3c5e0acff..74b3c03f6 100644 --- a/resources/self_hosting/deployment/running_production.mdx +++ b/resources/self_hosting/deployment/running_production.mdx @@ -44,6 +44,30 @@ Next, you need to make the binary accessible from anywhere in your system. Move mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +sudo restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + Meilisearch is now installed in your system, but it is not publicly accessible. ## Step 2: Create system user