Promtail启动报错「Failed to locate executable」权限问题求助

我最近用Promtail、Loki和Grafana给一堆服务器搭建监控系统，跟着一篇文章一步步操作下来，监控机（Rocky Linux 9.3）上的Loki和Grafana运行正常，二十多台Ubuntu服务器上的Promtail也能顺利把日志推送到Loki里，本来一切都挺顺利的。

可当我想给监控机自己也装上Promtail的时候，之前在其他服务器百试百灵的步骤突然不管用了，启动服务一直报「failed to locate executable」错误：

[root@localhost ~]# systemctl status promtail.service

× promtail.service - Promtail for Loki

Loaded: loaded (/etc/systemd/system/promtail.service; enabled; preset: disabled)

Active: failed (Result: exit-code) since Tue 2024-01-09 05:21:23 EST; 5s ago

Duration: 22ms

Process: 3633351 ExecStart=/usr/local/bin/promtail-linux-amd64 -config.file /etc/loki/promtail.yaml (code=exited, status=203/EXEC)

Main PID: 3633351 (code=exited, status=203/EXEC)

CPU: 21ms

Jan 09 05:21:23 localhost.localdomain systemd[1]: Started Promtail for Loki.

Jan 09 05:21:23 localhost.localdomain systemd[3633351]: promtail.service: Failed to locate executable /usr/local/bin/promtail-linux-amd64: Permission denied

Jan 09 05:21:23 localhost.localdomain systemd[3633351]: promtail.service: Failed at step EXEC spawning /usr/local/bin/promtail-linux-amd64: Permission denied

Jan 09 05:21:23 localhost.localdomain systemd[1]: promtail.service: Main process exited, code=exited, status=203/EXEC

Jan 09 05:21:23 localhost.localdomain systemd[1]: promtail.service: Failed with result 'exit-code'.

但我检查过了，可执行文件明明就在正确的路径下，而且所有者就是promtail用户：

[root@localhost ~]# ls -al /usr/local/bin/

total 165048

drwxr-xr-x+  3 root     root          128 Jan  2 12:35 .

drwxr-xr-x. 12 root     root          131 May 30  2023 ..

-rwxr-xr-x+  1 loki     loki     59424768 May  3  2023 loki-linux-amd64

-rw-r--r--+  1 root     root     18930096 May 31  2023 loki-linux-amd64.zip

-rwxr-xr-x.  1 root     root          233 Nov  6 11:53 normalizer

-rwxrwxr--+  1 promtail promtail 90640576 May  3  2023 promtail-linux-amd64

drwxr-xr-x.  7 root     root         4096 Jan  4 06:47 server_heartbeat

ACL权限也确认过，没问题：

[root@localhost ~]# getfacl /usr/local/bin/promtail-linux-amd64

getfacl: Removing leading '/' from absolute path names

# file: usr/local/bin/promtail-linux-amd64

# owner: promtail

# group: promtail

user::rwx

group::r-x

other::r--

服务配置文件里也明确指定了用promtail用户运行：

[Unit]
Description=Promtail for Loki
After=network.target

[Service]
Type=simple
User=promtail
ExecStart=/usr/local/bin/promtail-linux-amd64 -config.file /etc/loki/promtail.yaml
Restart=on-abort
NoNewPrivileges=true
PrivateTmp=yes
RestrictNamespaces=uts ipc pid user cgroup
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
#ProtectSystem=strict
#PrivateUsers=strict
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH

[Install]
WantedBy=multi-user.target

我实在搞不懂哪里出问题了，有没有大佬能指点一下？

补充：顺着@gerald-schneider的提示，我查了相关的SELinux上下文信息：

[root@localhost ~]# ls -Z /usr/local/bin/promtail-linux-amd64
unconfined_u:object_r:admin_home_t:s0 /usr/local/bin/promtail-linux-amd64

[root@localhost ~]# ls -Z /etc/loki/promtail.yaml
unconfined_u:object_r:admin_home_t:s0 /etc/loki/promtail.yaml

[root@localhost ~]# ls -Z /tmp/positions.yaml
unconfined_u:object_r:user_tmp_t:s0 /tmp/positions.yaml

备注：内容来源于stack exchange，提问作者Steven Blyatman Chayka