I'm trying to slurp a CentOS 7's filesystem to another CentOS 7 system
using rsyncd on the supplying side and rsync running as a client in a timer
unit on the client side. My backup script on the backup system runs fine
from the command line. When run from a systemd timer unit, rsync sends
nothing to the systemd log and I see a denial in the audit log for a Unix
domain socket in init_t context. I'm guessing it's trying to write to
stdout which is getting redirected to systemd's log. The service unit file
has StandardOutput=syslog in order to capture the list of files backed up.
The following selinux rule seems to fix this:
allow rsync_t init_t:unix_stream_socket { getattr read write };
I also found it necessary to add --no-devices and --no-specials to my
backup script, but I can live with that. A few devices show up in chroots
and postfix has some sockets in its package. Those are easily recreated if
I need to do a restore.
So is this selinux rule an oversight? Should there be an rsync bool for it?
Or was this fixed in a more recent version of systemd?