From 446e93b9c4126353c7af5335edd1e69efcba1699 Mon Sep 17 00:00:00 2001 From: Carlos Sosa Date: Sun, 2 Aug 2026 02:14:09 -0600 Subject: [PATCH 1/3] Document SELinux context restore after moving the binary On SELinux systems in enforcing mode (Fedora, RHEL, Rocky Linux, AlmaLinux, CentOS Stream, Amazon Linux), the meilisearch binary keeps the security context of the directory it was downloaded into after `mv ./meilisearch /usr/local/bin/`. systemd then refuses to execute it: Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied Add a note after the move step on the four self-hosting deployment guides explaining the cause and the `restorecon` fix. --- resources/self_hosting/deployment/aws.mdx | 24 +++++++++++++++++++ .../self_hosting/deployment/digitalocean.mdx | 24 +++++++++++++++++++ resources/self_hosting/deployment/gcp.mdx | 24 +++++++++++++++++++ .../deployment/running_production.mdx | 24 +++++++++++++++++++ 4 files changed, 96 insertions(+) diff --git a/resources/self_hosting/deployment/aws.mdx b/resources/self_hosting/deployment/aws.mdx index a7814c461..be232bf4d 100644 --- a/resources/self_hosting/deployment/aws.mdx +++ b/resources/self_hosting/deployment/aws.mdx @@ -52,6 +52,30 @@ Move the binary file into `/usr/local/bin` to make it accessible from anywhere: sudo mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Amazon Linux, Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +sudo restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + ## Step 2: Create system user Running applications as root exposes you to unnecessary security risks. Create a dedicated user for Meilisearch: diff --git a/resources/self_hosting/deployment/digitalocean.mdx b/resources/self_hosting/deployment/digitalocean.mdx index 41b91328b..d1ceec99a 100644 --- a/resources/self_hosting/deployment/digitalocean.mdx +++ b/resources/self_hosting/deployment/digitalocean.mdx @@ -45,6 +45,30 @@ Next, you need to make the binary accessible from anywhere in your system. Move mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + Meilisearch is now installed in your system, but it is not publicly accessible. ## Step 2: Create system user diff --git a/resources/self_hosting/deployment/gcp.mdx b/resources/self_hosting/deployment/gcp.mdx index 140cdecb4..851c87b9f 100644 --- a/resources/self_hosting/deployment/gcp.mdx +++ b/resources/self_hosting/deployment/gcp.mdx @@ -42,6 +42,30 @@ Move the binary to make it accessible system-wide: sudo mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +sudo restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + ## Step 2: Create system user Create a dedicated user for running Meilisearch: diff --git a/resources/self_hosting/deployment/running_production.mdx b/resources/self_hosting/deployment/running_production.mdx index 3c5e0acff..52608a0da 100644 --- a/resources/self_hosting/deployment/running_production.mdx +++ b/resources/self_hosting/deployment/running_production.mdx @@ -44,6 +44,30 @@ Next, you need to make the binary accessible from anywhere in your system. Move mv ./meilisearch /usr/local/bin/ ``` + +**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** + +If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. + +Restore the default context of the binary: + +```sh +restorecon -v /usr/local/bin/meilisearch +``` + +Then check the resulting label: + +```sh +ls -Z /usr/local/bin/meilisearch +``` + +The type must be `bin_t`: + +``` +unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch +``` + + Meilisearch is now installed in your system, but it is not publicly accessible. ## Step 2: Create system user From 770c90867099ba4a452877a05fed1a208f6aaa5f Mon Sep 17 00:00:00 2001 From: Carlos Sosa Date: Sun, 2 Aug 2026 02:54:20 -0600 Subject: [PATCH 2/3] Address review: state that mv preserves the binary's source SELinux context --- resources/self_hosting/deployment/aws.mdx | 2 +- resources/self_hosting/deployment/digitalocean.mdx | 2 +- resources/self_hosting/deployment/gcp.mdx | 2 +- resources/self_hosting/deployment/running_production.mdx | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/resources/self_hosting/deployment/aws.mdx b/resources/self_hosting/deployment/aws.mdx index be232bf4d..ac7180989 100644 --- a/resources/self_hosting/deployment/aws.mdx +++ b/resources/self_hosting/deployment/aws.mdx @@ -55,7 +55,7 @@ sudo mv ./meilisearch /usr/local/bin/ **SELinux systems: Amazon Linux, Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** -If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. Restore the default context of the binary: diff --git a/resources/self_hosting/deployment/digitalocean.mdx b/resources/self_hosting/deployment/digitalocean.mdx index d1ceec99a..accedf6a6 100644 --- a/resources/self_hosting/deployment/digitalocean.mdx +++ b/resources/self_hosting/deployment/digitalocean.mdx @@ -48,7 +48,7 @@ mv ./meilisearch /usr/local/bin/ **SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** -If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. Restore the default context of the binary: diff --git a/resources/self_hosting/deployment/gcp.mdx b/resources/self_hosting/deployment/gcp.mdx index 851c87b9f..a6baf9964 100644 --- a/resources/self_hosting/deployment/gcp.mdx +++ b/resources/self_hosting/deployment/gcp.mdx @@ -45,7 +45,7 @@ sudo mv ./meilisearch /usr/local/bin/ **SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** -If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. Restore the default context of the binary: diff --git a/resources/self_hosting/deployment/running_production.mdx b/resources/self_hosting/deployment/running_production.mdx index 52608a0da..ba44d9fad 100644 --- a/resources/self_hosting/deployment/running_production.mdx +++ b/resources/self_hosting/deployment/running_production.mdx @@ -47,7 +47,7 @@ mv ./meilisearch /usr/local/bin/ **SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream** -If SELinux runs in enforcing mode, the binary keeps the security context of the directory you downloaded it into. This prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. +`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`. Restore the default context of the binary: From eeca9a275ba7bbdcc4d6e8d52dc7a41898930290 Mon Sep 17 00:00:00 2001 From: Carlos Sosa Date: Wed, 5 Aug 2026 14:54:13 -0600 Subject: [PATCH 3/3] Use sudo for the restorecon command in the SELinux note --- resources/self_hosting/deployment/digitalocean.mdx | 2 +- resources/self_hosting/deployment/running_production.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/resources/self_hosting/deployment/digitalocean.mdx b/resources/self_hosting/deployment/digitalocean.mdx index accedf6a6..bc3631c77 100644 --- a/resources/self_hosting/deployment/digitalocean.mdx +++ b/resources/self_hosting/deployment/digitalocean.mdx @@ -53,7 +53,7 @@ mv ./meilisearch /usr/local/bin/ Restore the default context of the binary: ```sh -restorecon -v /usr/local/bin/meilisearch +sudo restorecon -v /usr/local/bin/meilisearch ``` Then check the resulting label: diff --git a/resources/self_hosting/deployment/running_production.mdx b/resources/self_hosting/deployment/running_production.mdx index ba44d9fad..74b3c03f6 100644 --- a/resources/self_hosting/deployment/running_production.mdx +++ b/resources/self_hosting/deployment/running_production.mdx @@ -52,7 +52,7 @@ mv ./meilisearch /usr/local/bin/ Restore the default context of the binary: ```sh -restorecon -v /usr/local/bin/meilisearch +sudo restorecon -v /usr/local/bin/meilisearch ``` Then check the resulting label: