I want to launch the Tomcat service on CentOS with the cmdlet :

systemctl start tomcat.service

but i get the error

Failed to start Apache ExecStart=/opt/tomcat/bin/startup.sh (code=exited, status=203/EXEC).

and the log through the command :

Journalctl -xe 

is stating that

Selinux is preventing (artup.sh) from execute access on the file startup.sh

given that i can start any other service on my CentOS what could be the problem for my tomcat service ?

Thank you

  • Do the normal troubleshooting. Commented Sep 3, 2020 at 19:55
  • or maybe turn on the permissive mode for SELinux ? please elaborate your ans.
    – welwelwel
    Commented Sep 3, 2020 at 20:01
  • You need to click the link and understand how to troubleshoot the problem. Commented Sep 3, 2020 at 20:05

1 Answer 1


The SELinux restricts binaries that can be used in ExecStart to paths that has system_u:object_r:bin_t:s0 attribute set. Typically those are /usr/bin /usr/sbin /usr/libexec /usr/local/bin directories.

You need to move the script into one of this directories or change selinux policy to allow systemd to use binaries in the desired location as:

chcon -R -t bin_t /opt/tomcat/bin/

A restorecon will 'unfix' the above better to update the policy e.g.

semanage fcontext -a -t bin_t "/opt/tomcat/bin(/.*)?"
restorecon -r -v /opt/tomcat/bin


If java binary is not located in the standard location (custom JVM distribution), then you need to set bin_t label to it as well. For example, it your JVM installed in /opt/java, then:

semanage fcontext -a -t bin_t "/opt/java/bin(/.*)?"
restorecon -r -v /opt/java/bin

NOTICE: systemd ignores JAVA_HOME environment variable if it's not set in unit file.

  • seems promising direction, i will try quick
    – welwelwel
    Commented Sep 6, 2020 at 0:25
  • Actually the Exec error is still there returning control process with error 1
    – welwelwel
    Commented Sep 7, 2020 at 10:31
  • Check the location of java binary as well
    – kofemann
    Commented Sep 7, 2020 at 11:30
  • as the JAVA_HOME path i use the /jre location (specified without the "")
    – welwelwel
    Commented Sep 7, 2020 at 11:32
  • It should have bin_t label as vell
    – kofemann
    Commented Sep 7, 2020 at 11:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .