Package: selinux-policy-default
Version: 2:2.20250213-10
Severity: normal
Dear Maintainer,
On Debian 13 with SELinux in Enforcing mode, snapperd starts but runs
with the SELinux domain initrc_t.
D-Bus requests to snapperd then time out. At the same time, SELinux AVC
denials are recorded for D-Bus send_msg operations with the source
context:
system_u:system_r:initrc_t:s0
Observed behaviour:
* snapperd.service starts successfully.
* busctl introspection of the Snapper D-Bus service times out.
* snapper.real list-configs times out when using D-Bus.
* snapper.real -c root list times out when using D-Bus.
* The equivalent commands succeed immediately with --no-dbus.
* SELinux is in Enforcing mode.
* snapperd is running in initrc_t rather than a dedicated Snapper domain.
The installed Snapper package was rebuilt locally from the Debian
source package with only one functional packaging change:
--enable-selinux
The rebuilt binary reports SELinux support. No local SELinux policy
module was added for Snapper.
This suggests that the current Debian SELinux policy does not provide
a suitable domain transition and/or D-Bus permissions for snapperd.
Attached are:
* system summary;
* relevant AVC records;
* results of the D-Bus tests;
* results of equivalent --no-dbus tests.
The complete diagnostic archive is available on request.
Regards,
Vadim
