Add SELinux note after moving the binary in the self-hosting deployment guides

resources/self_hosting/deployment/aws.mdx

@@ -52,6 +52,30 @@ Move the binary file into `/usr/local/bin` to make it accessible from anywhere:
 sudo mv ./meilisearch /usr/local/bin/
 ```
 
+<Note>
+**SELinux systems: Amazon Linux, Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream**
+
+`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`.
+
+Restore the default context of the binary:
+
+```sh
+sudo restorecon -v /usr/local/bin/meilisearch
+```
+
+Then check the resulting label:
+
+```sh
+ls -Z /usr/local/bin/meilisearch
+```
+
+The type must be `bin_t`:
+
+```
+unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch
+```
+</Note>
+
 ## Step 2: Create system user
 
 Running applications as root exposes you to unnecessary security risks. Create a dedicated user for Meilisearch:

resources/self_hosting/deployment/digitalocean.mdx

@@ -45,6 +45,30 @@ Next, you need to make the binary accessible from anywhere in your system. Move
 mv ./meilisearch /usr/local/bin/
 ```
 
+<Note>
+**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream**
+
+`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`.
+
+Restore the default context of the binary:
+
+```sh
+sudo restorecon -v /usr/local/bin/meilisearch
+```
+
+Then check the resulting label:
+
+```sh
+ls -Z /usr/local/bin/meilisearch
+```
+
+The type must be `bin_t`:
+
+```
+unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch
+```
+</Note>
+
 Meilisearch is now installed in your system, but it is not publicly accessible.
 
 ## Step 2: Create system user

resources/self_hosting/deployment/gcp.mdx

@@ -42,6 +42,30 @@ Move the binary to make it accessible system-wide:
 sudo mv ./meilisearch /usr/local/bin/
 ```
 
+<Note>
+**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream**
+
+`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`.
+
+Restore the default context of the binary:
+
+```sh
+sudo restorecon -v /usr/local/bin/meilisearch
+```
+
+Then check the resulting label:
+
+```sh
+ls -Z /usr/local/bin/meilisearch
+```
+
+The type must be `bin_t`:
+
+```
+unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch
+```
+</Note>
+
 ## Step 2: Create system user
 
 Create a dedicated user for running Meilisearch:

resources/self_hosting/deployment/running_production.mdx

@@ -44,6 +44,30 @@ Next, you need to make the binary accessible from anywhere in your system. Move
 mv ./meilisearch /usr/local/bin/
 ```
 
+<Note>
+**SELinux systems: Fedora, RHEL, Rocky Linux, AlmaLinux, and CentOS Stream**
+
+`mv` preserves the binary's original SELinux context instead of relabeling it for its new location, so the file in `/usr/local/bin` keeps the context of the directory you downloaded it into. If SELinux runs in enforcing mode, this prevents systemd from running it in [step 4](#step-4-run-meilisearch-as-a-service), which fails with `Failed at step EXEC spawning /usr/local/bin/meilisearch: Permission denied`.
+
+Restore the default context of the binary:
+
+```sh
+sudo restorecon -v /usr/local/bin/meilisearch
+```
+
+Then check the resulting label:
+
+```sh
+ls -Z /usr/local/bin/meilisearch
+```
+
+The type must be `bin_t`:
+
+```
+unconfined_u:object_r:bin_t:s0 /usr/local/bin/meilisearch
+```
+</Note>
+
 Meilisearch is now installed in your system, but it is not publicly accessible.
 
 ## Step 2: Create system user