[DSE-Dev] Bug#1142956: snapperd runs in initrc_t and D-Bus requests time out under SELinux Enforcing

[Вадим]

Package: selinux-policy-default
Version:  2:2.20250213-10
Severity: normal

Dear Maintainer,

On Debian 13 with SELinux in Enforcing mode, snapperd starts but runs
with the SELinux domain initrc_t.

D-Bus requests to snapperd then time out. At the same time, SELinux AVC
denials are recorded for D-Bus send_msg operations with the source
context:

    system_u:system_r:initrc_t:s0

Observed behaviour:

* snapperd.service starts successfully.
* busctl introspection of the Snapper D-Bus service times out.
* snapper.real list-configs times out when using D-Bus.
* snapper.real -c root list times out when using D-Bus.
* The equivalent commands succeed immediately with --no-dbus.
* SELinux is in Enforcing mode.
* snapperd is running in initrc_t rather than a dedicated Snapper domain.

The installed Snapper package was rebuilt locally from the Debian
source package with only one functional packaging change:

    --enable-selinux

The rebuilt binary reports SELinux support. No local SELinux policy
module was added for Snapper.

This suggests that the current Debian SELinux policy does not provide
a suitable domain transition and/or D-Bus permissions for snapperd.

Attached are:

* system summary;
* relevant AVC records;
* results of the D-Bus tests;
* results of equivalent --no-dbus tests.

The complete diagnostic archive is available on request.

Regards,
Vadim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/selinux-devel/attachments/20260728/eb425320/attachment.htm>
-------------- next part --------------
$ timeout 30 /usr/bin/snapper.real -c root list


[exit code: 124]
-------------- next part --------------
$ sh -c 
        ausearch             -m AVC,USER_AVC,SELINUX_ERR             -ts '20:08:17' 2>/dev/null || true
    

----
time->Tue Jul 28 20:08:20 2026
type=USER_AVC msg=audit(1785258500.498:3281): pid=967 uid=989 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.313 spid=30174 tpid=30185 scontext=system_u:system_r:initrc_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
----
time->Tue Jul 28 20:08:40 2026
type=USER_AVC msg=audit(1785258520.509:3282): pid=967 uid=989 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.314 spid=30174 tpid=30187 scontext=system_u:system_r:initrc_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
----
time->Tue Jul 28 20:08:43 2026
type=USER_AVC msg=audit(1785258523.525:3283): pid=967 uid=989 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.315 spid=30174 tpid=30192 scontext=system_u:system_r:initrc_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
----
time->Tue Jul 28 20:09:13 2026
type=USER_AVC msg=audit(1785258553.535:3286): pid=967 uid=989 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.316 spid=30174 tpid=30214 scontext=system_u:system_r:initrc_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=989 hostname=? addr=? terminal=?'
-------------- next part --------------
$ timeout 30 /usr/bin/snapper.real list-configs


[exit code: 124]
-------------- next part --------------
$ timeout 30 /usr/bin/snapper.real --no-dbus list-configs

Конфигурация | Субтом
-------------+-------
home         | /home 
root         | /     

[exit code: 0]