snapd: dbus avc permissions denied

[Harold Dost]

Since 2.46.1 there were new dbus service files added. Which has dbus-broker watch /var/lib/snapd/dbus-1/system-services

but unfortunately there exists no selinux policy to compliment this which causes the following error:
```
Feb 13 19:41:45 dosttop.local audit[1375]: AVC avc: denied { watch } for pid=1375 comm="dbus-broker-lau" path="/var/lib/snapd/dbus-1/system-services" dev="dm-0" ino=200946 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tc>
```

This results in the system starting anything reliant on dbus failing.

I would write a patch, but I'm a novice when it comes to selinux and while i've fixed it locally I'm not sure, but I believe this would be added to https://github.com/snapcore/snapd/blob/master/data/selinux/snappy.te

[Maciej Borzecki (maciek-borzecki)]

Is this on rawhide? I see that basic support for watch landed a week ago in the reference policy.

[Maciej Borzecki (maciek-borzecki)]

Opened https://github.com/snapcore/snapd/pull/9935 for snapd. Probably needs a distro patch in Fedora too.

I still cannot understand why dbus doesn't simply continue working, but watching only the directories it could access.

[Harold Dost (hdost3)]

Yea this was in rawhide.

Also yes I would agree, but I'm sure this is one of these situations where making it optional might cause more issues as certain things are expected to work.

[Maciej Borzecki (maciek-borzecki)]

The PR has landed. I'll cherry pick the patch to a Fedora package and try to get it updated in rawhide.

[Maciej Borzecki (maciek-borzecki)]

The update in rawhide has already landed: https://bodhi.fedoraproject.org/updates/FEDORA-2021-1fbf3893fe