Runner: Service doesn't work with SELinux (by default)

[parndt]

Describe the bug
With SELinux enabled the service file is created with incorrect permissions.

To Reproduce
Steps to reproduce the behavior (using github user):

1. Run ./svc.sh install github as root user.
2. See error

Expected behaviour
I expected the service to be installed.

Runner Version and Platform

Version of your runner? v2.168.0

OS of the machine running the runner? Linux - Fedora 31

What's not working?

Creating launch runner in /etc/systemd/system/actions.runner.org-repo.linux-1.service
Run as user: github
Run as uid: 1003
gid: 1003
Failed to enable unit: Unit file actions.runner.org-repo.linux-1.service does not exist.
Failed: failed to enable actions.runner.org-repo.linux-1.service

This is fixed with restorecon -r -v /etc/systemd/system/actions.runner.*.service

Job Log Output

N/A

Runner and Worker's Diagnostic Logs

N/A

[parndt]

Wow, thanks @TingluoHuang ! 🎉 👏

[justin-stephenson]

After this addressed the problem with sudo svc.sh install I also needed to run this to start the service:

~
chcon system_u:object_r:usr_t:s0 runsvc.sh
~
To address another SELinux denial
~
type=AVC msg=audit(1592338946.550:5146): avc: denied { execute } for pid=207085 comm="(unsvc.sh)" name="runsvc.sh" dev="dm-0" ino=278162 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
~