Login or Register
FULL AI ANALYSIS

systemd service ExecStart script returns 'Permission denied' only when run as non-root user after unit file move

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

Status=203/EXEC and 'Permission denied' indicate the service user lacks execute permission for the script. The script was mode 750 with owner root:root; with User=appuser, group root does not include appuser, so execute bit for 'group' doesn't grant access. Changing file mode to 755 allowed execution. Moving unit file to /etc may have changed expectations about ownership/packaging but the root cause is UNIX file permissions and the service running as a different user with shell set to nologin (affects interactive runs but not systemd execution).

Possible causes

Script file lacks execute permission for service user because file owner/group and mode restrict access

95%

Service configured to run as appuser but file belongs to root:root without appropriate group membership

90%

Filesystem mount options (noexec) could cause similar error — not the case here given root can run it

0%

SELinux/AppArmor could block execution, but audit logs are clean

0%

Suggested fixes

1

Diagnostic step 1

Set a least-privilege ownership that allows execution: chown root:appgroup /usr/local/bin/myapp-start.sh and chmod 750, ensuring appuser is in appgroup. Verify with su -s /bin/bash appuser -c '/usr/local/bin/myapp-start.sh' (use safe test methods that avoid exposing secrets).

2

Diagnostic step 2

Alternatively, place the executable in a directory where appuser already has execute permission (e.g., /opt/myapp) and set appropriate ownership. Avoid setting 777.

3

Diagnostic step 3

Check for mount options: mount | grep '/usr/local' to ensure noexec is not set. If present, move script or adjust mount in fstab (requires reboot).

4

Diagnostic step 4

If service needs to run privileged steps, keep ExecStart as root wrapper that drops privileges internally; avoid running entire service as root. If AppArmor/SELinux denials appear, collect audit logs and escalate to OS/security specialist with AVC logs.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads