Package: selinux-policy-default
Version: 2:2.20250213-10
Severity: normal
Dear Maintainer,
On Debian 13 with SELinux in Enforcing mode, snapperd starts but runs
with the SELinux domain initrc_t.
D-Bus requests to snapperd then time out. At the same time, SELinux AVC
denials are recorded for D-Bus send_msg operations with the source
context:
system_u:system_r:initrc_t:s0
Observed behaviour:
* snapperd.service starts successfully.
* busctl introspection of the Snapper D-Bus service times out.
* snapper.real list-configs times out when using D-Bus.
* snapper.real -c root list times out when using D-Bus.
* The equivalent commands succeed immediately with --no-dbus.
* SELinux is in Enforcing mode.
* snapperd is running in initrc_t rather than a dedicated Snapper domain.
The installed Snapper package was rebuilt locally from the Debian
source package with only one functional packaging change:
--enable-selinux
The rebuilt binary reports SELinux support. No local SELinux policy
module was added for Snapper.
This suggests that the current Debian SELinux policy does not provide
a suitable domain transition and/or D-Bus permissions for snapperd.
Attached are:
* system summary;
* relevant AVC records;
* results of the D-Bus tests;
* results of equivalent --no-dbus tests.
The complete diagnostic archive is available on request.
Regards,
Vadim
$ timeout 30 /usr/bin/snapper.real -c root list
[exit code: 124]
$ sh -c
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts
'20:08:17' 2>/dev/null || true
----
time->Tue Jul 28 20:08:20 2026
type=USER_AVC msg=audit(1785258500.498:3281): pid=967 uid=989 auid=4294967295
ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied {
send_msg } for msgtype=method_return dest=:1.313 spid=30174 tpid=30185
scontext=system_u:system_r:initrc_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus
permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
----
time->Tue Jul 28 20:08:40 2026
type=USER_AVC msg=audit(1785258520.509:3282): pid=967 uid=989 auid=4294967295
ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied {
send_msg } for msgtype=method_return dest=:1.314 spid=30174 tpid=30187
scontext=system_u:system_r:initrc_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus
permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
----
time->Tue Jul 28 20:08:43 2026
type=USER_AVC msg=audit(1785258523.525:3283): pid=967 uid=989 auid=4294967295
ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied {
send_msg } for msgtype=method_return dest=:1.315 spid=30174 tpid=30192
scontext=system_u:system_r:initrc_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus
permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
----
time->Tue Jul 28 20:09:13 2026
type=USER_AVC msg=audit(1785258553.535:3286): pid=967 uid=989 auid=4294967295
ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied {
send_msg } for msgtype=method_return dest=:1.316 spid=30174 tpid=30214
scontext=system_u:system_r:initrc_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus
permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
$ timeout 30 /usr/bin/snapper.real list-configs
[exit code: 124]
$ timeout 30 /usr/bin/snapper.real --no-dbus list-configs
Конфигурация | Субтом
-------------+-------
home | /home
root | /
[exit code: 0]
