Have you checked the audit log? You can get away with a lot of stuff in an interactive session that will be prohibited by SELinux when started from a systemd service. Systemd then hides that real reason from you in a double-whammy. Worth ruling out at the very least.