Bugzilla – Bug 1218872
Cannot create snapper snapshots with SELinux
Last modified: 2024-01-17 13:41:44 UTC
Overview: Cannot utilize snapper-timeline to create a snapper configuration in a non-exempt location, and snapshot a btrfs subvolume without from interference from SELinux. Steps to Reproduce: 1. Create a Subvolume. btrfs subvolume create /srv/foo 2. Create a snapper configuration for subvolume snapper --config foo create-config /srv/foo 3. Examine SELinux File Context. SELinux File Context Type is as expected snapper_data_t ls -laz 4. snapper-timeline fails with IO Error (mkdir failed errno:13 (Permission denied)) journalctl --unit snapper-timeline.service --since today 5. When snapper-timeline.service runs, the SELinux File Context Type on the subvolume is changed to var_t. ls -laZ. Actual Results Snapper Timeline Fails, No Snapshots are created. Expected Results Snapshots are Created, preserving the SELinux File Context. Additional Information: This issue involves multiple components snapper, systemd, semanage, Startup SELinux exempts only certain directories for snapshots, observed via semanage fcontext --list |grep .snapshots One file context entry sets the snapshot directory to snapper_data_t and another entry to ignore the SELinux File Context of the snapshot Contents via <<none>> semanage fcontext allows you to add additional paths set to context to snapper_data_t, however semanage fcontext has no facility to set to <<none>>, the command requires a --type must be defined. the file context of the .snapshot directory can be manually changed to snapper_data_t, this allows snapper-timeline to create snapshots. However during a SELinux relabel on startup, this causes errors on system startup, and drop to Emergency Maintenance. This is caused by the system unable to relabel the read-only snapshot.
Thanks for the detailed bugreport, i was able to reproduce it and will have a look.
Since you are using a non-default path, I think the right way is to add the file context via semanage, as you already tried to do. I think semanage can set the file context to <<none>> though. Try using this on your custom directory /srv/foo before running your commands: semanage fcontext -a -t '<<none>>' '/srv/foo/\.snapshots/[^/]*/snapshot(/.*)?' semanage fcontext -a -t 'snapperd_data_t' '/srv/foo/\.snapshots(/.*)?' I think that should resolve your issue as this then should not relabel the snapshot content. Please let me know if your issue still persists, thanks!
Thanks, looking back at the command history, of all the permutations I was trying I was having trouble with how to specify <<none>>.