AVC SELinux

Ask Fedora
, ,
1

I’m slightly overwhelmed by this suggestions of SeLinux. What do I need to do here?

SELinux is preventing snapperd from create access on the directory 1.

*****  Plugin catchall_labels (83.8 confidence) suggests   *******************

If you want to allow snapperd to have create access on the 1 directory
Then you need to change the label on 1
Do
# semanage fcontext -a -t FILE_TYPE '1'
where FILE_TYPE is one of the following: snapperd_conf_t, snapperd_data_t, unlabeled_t.
Then execute:
restorecon -v '1'


*****  Plugin catchall (17.1 confidence) suggests   **************************

If you believe that snapperd should be allowed create access on the 1 directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'snapperd' --raw | audit2allow -M my-snapperd
# semodule -X 300 -i my-snapperd.pp

Additional Information:
Source Context                system_u:system_r:snapperd_t:s0
Target Context                system_u:object_r:usr_t:s0
Target Objects                1 [ dir ]
Source                        snapperd
Source Path                   snapperd
Port                          <Unknown>
Host                          ws-living
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-44.2-1.fc44.noarch
Local Policy RPM              selinux-policy-targeted-44.2-1.fc44.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     ws-living
Platform                      Linux ws-living 7.0.11-200.fc44.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Mon Jun  1 22:50:37 UTC 2026
                              x86_64
Alert Count                   8
First Seen                    2026-06-12 19:00:01 CEST
Last Seen                     2026-06-13 09:00:06 CEST
Local ID                      49547b12-6bd5-4e79-8fe6-a587bceb4dd0

Raw Audit Messages
type=AVC msg=audit(1781334006.50:456): avc:  denied  { create } for  pid=206541 comm="snapperd" name="1" scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0


Hash: snapperd,snapperd_t,usr_t,dir,create
3

Is it saying that your Snapper application is trying to create things under /usr? It doesn’t seem like it should be attempting to do that.

4

I just used Btrfs-assistant to create a snapper schedule. Does Btrfs-assistant use /usr?

5

I don’t know anything about Btrfs assistant. I wouldn’t expect it to want to write anything to /usr. I would guess that it should only need read access to the things it is backing up. But I don’t know.

I think Snapper isn’t well-supported under Fedora Linux. If you want to turn off SELinux denials for all Snapper applications, you could probably set the whole domain to be permissive with the following command:

semanage permissive -a snapperd_t

Do that at your own risk of course. It should prevent SELinux from interferring with any Snapper application, but if one contains malware, then that will be allowed through as well.

6

Those commands would attempt to craft a tailored SELinux policy that would allow only the specific access that was being denied the first time you ran the program. That would be the better way to open up access to the specific Snapper application that you are having problems with. The caveat is that you might find that your program still doesn’t work because, after you allow access to that file/directory and run it again, it will fail again if it tries to access a different directory. It can be very tedious generating all the access rules one-by-one like that. An alternative is to temporarily set the domain permissive, run the program to completion, then set the domain back to enforcing and run those two commands to generate a full SELinux policy that grants access to all the files and directories that the program accessed. As long as your program doesn’t change what it accesses between one run and the next, that should work.