[DSE-Dev] Bug#1142957:

[Вадим]

Package: selinux-policy-default
Version:  2:2.20250213-10
Severity: normal

Dear Maintainer,

On Debian 13 with SELinux in Enforcing mode, snapperd starts but runs
with the SELinux domain initrc_t.

D-Bus requests to snapperd then time out. At the same time, SELinux AVC
denials are recorded for D-Bus send_msg operations with the source
context:

    system_u:system_r:initrc_t:s0

Observed behaviour:

* snapperd.service starts successfully.
* busctl introspection of the Snapper D-Bus service times out.
* snapper.real list-configs times out when using D-Bus.
* snapper.real -c root list times out when using D-Bus.
* The equivalent commands succeed immediately with --no-dbus.
* SELinux is in Enforcing mode.
* snapperd is running in initrc_t rather than a dedicated Snapper domain.

The installed Snapper package was rebuilt locally from the Debian
source package with only one functional packaging change:

    --enable-selinux

The rebuilt binary reports SELinux support. No local SELinux policy
module was added for Snapper.

This suggests that the current Debian SELinux policy does not provide
a suitable domain transition and/or D-Bus permissions for snapperd.

Attached are:

* system summary;
* relevant AVC records;
* results of the D-Bus tests;
* results of equivalent --no-dbus tests.

The complete diagnostic archive is available on request.

Regards,
Vadim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/selinux-devel/attachments/20260728/cf8f6b0b/attachment.htm>