3253160 - SAP instance or Host Agent startup fails due to SELinux

The start of the Host Agent, or SAP instance managed through sapstartsrv fail, with errors such as:

- Linux /var/log/messages file:

Aug 16 19:32:58 <hostname> systemd[1]: Starting SAP Host Agent...
Aug 16 19:32:58 <hostname> systemd[20890]: saphostagent.service: Failed to execute command: Permission denied
Aug 16 19:32:58 <hostname> systemd[20890]: saphostagent.service: Failed at step EXEC spawning /usr/sap/hostctrl/exe/saphostexec: Permission denied
Aug 16 19:32:58 <hostname> systemd[1]: saphostagent.service: Control process exited, code=exited status=203
Aug 16 19:32:58 <hostname> systemd[1]: saphostagent.service: Failed with result 'exit-code'.
Aug 16 19:32:58 <hostname> systemd[1]: Failed to start SAP Host Agent.
Aug 16 19:32:58 <hostname> dbus-daemon[2629]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.31' (uid=0 pid=2311 comm="/usr/sbin/sedispatch " label="system_u:system_r:auditd_t:s0") (using servicehelper)
Aug 16 19:32:59 <hostname> dbus-daemon[2629]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Aug 16 19:32:59 <hostname> setroubleshoot[20894]: SELinux is preventing /usr/bin/bash from execute access on the file /usr/sap/hostctrl/exe/saphostexec. For complete SELinux messages run: sealert -l 6a31f354-8278-48da-b25b-ee60272b6532
Aug 16 19:32:59 hostname platform-python[20894]: SELinux is preventing /usr/bin/bash from execute access on the file /usr/sap/hostctrl/exe/saphostexec.

- Linux audit log:

type=AVC msg=audit(1656484975.820:1750): avc:  denied  { execute } for  pid=180021 comm="(hostexec)" name="saphostexec" dev="dm-4" ino=131076 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=fil

- SAP dev_* files, sapinst_dev file:

[Thr 140579911310336] Tue Aug 16 18:54:08 2022
[Thr 140579911310336] *** ERROR => systemdI_msg_handler: job '/org/freedesktop/systemd1/job/5114784' canceled with 'failed' [systemd.cpp  1372]
[ERROR] Failed to start saphostagent.service: systemdI_msg_handler: job '/org/freedesktop/systemd1/job/5114784' canceled with 'failed'

- sapcontrol shows:

hostname:<sid>adm 64> sapcontrol -nr 00 -function StartService <SID>

StartService
FAIL: Service start failed: systemdI_msg_handler: job '/org/freedesktop/systemd1/job/673403' canceled with 'failed'

Red Hat Enterprise Linux 8

Oracle Linux 8

SAP kernel components, that have the systemd integration. Starting patch levels are in:

3139184 - Linux: systemd integration for sapstartsrv and SAP Host Agent

SELinux, systemd, systemdI_msg_handler, permissive, enforcing,freedesktop/systemd1 , KBA , BC-OP-LNX , Linux , BC-OP-LNX-OLNX , Oracle Linux , BC-OP-LNX-RH , Red Hat Linux , Known Error