Description of problem: boot with enforcing=1 started failing for me as dbus is blocked from watching system services directory, and can't recover. this started after upgrade from F33 to F25. SELinux is preventing dbus-broker-lau from 'watch' accesses on the directory /var/lib/snapd/dbus-1/system-services. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow dbus-broker-lau to have watch access on the system-services directory Then you need to change the label on /var/lib/snapd/dbus-1/system-services Do # semanage fcontext -a -t FILE_TYPE '/var/lib/snapd/dbus-1/system-services' where FILE_TYPE is one of the following: dbusd_etc_t, system_dbusd_tmp_t, system_dbusd_tmpfs_t, system_dbusd_var_run_t, user_tmp_t, usr_t. Then execute: restorecon -v '/var/lib/snapd/dbus-1/system-services' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that dbus-broker-lau should be allowed watch access on the system-services directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'dbus-broker-lau' --raw | audit2allow -M my-dbusbrokerlau # semodule -X 300 -i my-dbusbrokerlau.pp Additional Information: Source Context system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_lib_t:s0 Target Objects /var/lib/snapd/dbus-1/system-services [ dir ] Source dbus-broker-lau Source Path dbus-broker-lau Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages snapd-2.54.1-1.fc35.x86_64 SELinux Policy RPM selinux-policy-targeted-35.8-1.fc35.noarch Local Policy RPM selinux-policy-targeted-35.8-1.fc35.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 5.15.13-200.fc35.x86_64 #1 SMP Wed Jan 5 16:39:13 UTC 2022 x86_64 x86_64 Alert Count 2 First Seen 2022-01-07 04:50:06 EST Last Seen 2022-01-07 19:06:06 EST Local ID 449326c4-b4ca-40ce-b727-78bbb4b48f75 Raw Audit Messages type=AVC msg=audit(1641600366.953:138): avc: denied { watch } for pid=883 comm="dbus-broker-lau" path="/var/lib/snapd/dbus-1/system-services" dev="nvme0n1p6" ino=2370118 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=1 Hash: dbus-broker-lau,system_dbusd_t,var_lib_t,dir,watch Version-Release number of selected component: selinux-policy-targeted-35.8-1.fc35.noarch Additional info: component: selinux-policy reporter: libreport-2.15.2 hashmarkername: setroubleshoot kernel: 5.15.13-200.fc35.x86_64 type: libreport
*** This bug has been marked as a duplicate of bug 1928365 ***