The syncthing package provides this file: $ ls -lZ /usr/lib/systemd/user/syncthing.service -rw-r--r--. 1 root root system_u:object_r:lib_t:s0 285 Nov 6 00:18 /usr/lib/systemd/user/syncthing.service The obvious thing to do with this file is something like: $ cd ~/.config/systemd/user/ $ ln -s /usr/lib/systemd/user/syncthing.service But that won't work properly with selinux because the context is wrong; that file's type should be systemd_unit_file_t , not lib_t
Turns out you don't need to symlink things in that directory, you can just use them directly, but the problem still stands: Nov 22 22:56:52 vrici systemd[958]: selinux: avc: denied { start } for auid=n/a uid=1000 gid=1000 path="/usr/lib/systemd/user/syncthing.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service permissive=1 Nov 22 22:56:52 vrici systemd[958]: selinux: avc: denied { status } for auid=n/a uid=1000 gid=1000 path="/usr/lib/systemd/user/syncthing.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service permissive=1 Nov 22 22:57:00 vrici systemd[958]: selinux: avc: denied { stop } for auid=n/a uid=1000 gid=1000 path="/usr/lib/systemd/user/syncthing.service" cmdline="" scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service permissive=1
Having said all of that, though, it looks like *all* the files in that dir have the wrong context, which makes it a problem for the selinux policy ; see https://bugzilla.redhat.com/show_bug.cgi?id=1652814
Curious. I am using syncthing in this setup (user service, SELinux enforcing) for years, and I haven't had any avc denials happen. But I can confirm that the selinux context for those files is the same here, and that this is an issue with the selinux policy. As you already opened a bug there, I'll close this report for syncthing as I can't do anything about this. *** This bug has been marked as a duplicate of bug 1652814 ***
I expect that it's working for you because you have the "unconfined" module enabled; I have it turned off, cuz I'm crazy. :D
Ah, I see. I didn't even know that was possible. TIL, I guess. :)