From 1331a2cd114ace589b4014d4c013c9afec52d6a9 Mon Sep 17 00:00:00 2001
From: EduCampi <21183066+EduCampi@users.noreply.github.com>
Date: Mon, 23 Feb 2026 17:54:23 +0100
Subject: [PATCH] Add steps to make it work wit SELinux

Services are not meant to launch binaries under /var, which is where Vanta installs its binaries and points the service to. Ideally, those would be moved somewhere like /usr/local/bin/vanta , but it turns out the path is also hardcoded in the binaries themselves, so they'll try creating logs, lock files, and looking for their binaries in that hardcoded location. To workaround that, we need to modify the SE context tag to make the folder and its binaries look like, well, binaries.

It is important to also check /etc/vanta.conf to ensure the key and owner are configured properly.

This is verified to work in a Fedora atomic distro like Fedora Kinoite. It was necessary to manually copy  over the binaries as the ` rpm-ostree`  installation method only installed the service definition and conf files, but was unable to create the /var/vanta folder.
---
 README.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/README.md b/README.md
index 890aa2a..93aeac2 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,19 @@ With configuration (use `.envrc`):
 sudo -E rpm -ivh rpmbuild/RPMS/x86_64/vanta-*.rpm
 ```
 
+### Regarding SELinux
+
+Vanta will expect all its binaries to be located at `/var/vanta`.
+
+1. After installation, verify the files actually exist. If they're not there, copy over the folder `vanta` located at `vanta-rpm/assets/var/vanta` after having built the rpm.
+2. Modify the SELinux context so the service can see and execute them
+```
+sudo semanage fcontext -a -t bin_t '/var/vanta(/.*)?'
+sudo restorecon -Rv /var/vanta
+```
+3. Verify the key and owner values are populated in `/etc/vanta.conf`
+4. Start and enable the service by running `sudo systemctl enable --now vanta.service`
+
 ## Other Targets
 
 ```bash