SELinux denials for 'qs' process on Fedora (accessing / and /var)

### Compositor

Niri

### Distribution

Fedora

### If Other, please specify

_No response_

### Select your Installation Method

DankInstaller

### Was this your original Installation method?

Yes

### If no, specify

_No response_

### dms doctor -vC

Click to expand
## DMS Doctor Report

**System**
- [ok] Operating System: Fedora Linux 43 (Workstation Edition)
- ID: fedora, Version: 43, Arch: amd64
- [ok] Architecture: amd64
- [ok] Display Server: Wayland
- WAYLAND_DISPLAY=wayland-1

**Versions**
- [ok] DMS CLI: dms (git) v1.5-3564
- /usr/bin/dms
- [ok] Quickshell: Quickshell 0.2.1 (revision d4c92973b53d9fa34cc110d3b974eb6bde5b3027, distributed by Fedora COPR (avengemedia/quickshell))
- /usr/bin/qs
- [ok] DMS Shell: v1.5-beta
- /usr/share/quickshell/dms

**Installation**
- [ok] DMS Configuration: Found
- /usr/share/quickshell/dms
- [ok] shell.qml: Present
- /usr/share/quickshell/dms/shell.qml
- [info] Install Type: System package
- /usr/share/quickshell/dms

**Compositor**
- [ok] niri: 25.11
- /usr/local/bin/niri
- [info] Active: niri

**Quickshell Features**
- [ok] Polkit: Available
- Authentication prompts
- [ok] IdleMonitor: Available
- Idle detection
- [ok] IdleInhibitor: Available
- Prevent idle/sleep
- [ok] ShortcutInhibitor: Available
- Allow shortcut management (niri)

**Optional Features**
- [ok] accountsservice: Available
- User accounts
- [ok] power-profiles-daemon: Available
- Power profile management
- [ok] logind: Available
- Session management
- [ok] cups-pk-helper: Available
- Printer management
- [info] I2C/DDC: No monitors detected
- External monitor brightness control
- [ok] qt6-imageformats: Installed (1 formats)
- Formats: GIF (/usr/lib64/qt6/plugins/imageformats)
- [ok] kimageformats: Installed (4 formats)
- Formats: AVIF, HEIF, JXL, EXR (/usr/lib64/qt6/plugins/imageformats)
- [ok] Terminal: ghostty, alacritty, wezterm
- [ok] Network: NetworkManager
- NetworkManager present. Using NM API.
- [ok] matugen: Installed
- Dynamic theming
- [ok] dgop: Installed
- System monitoring
- [ok] cava: Installed
- Audio visualizer
- [info] khal: Not installed
- Calendar events
- [ok] danksearch: Installed
- File search
- [ok] fprintd: Installed
- Fingerprint auth

**Config Files**
- [ok] settings.json: Present
- /home/flyingbucket/.config/DankMaterialShell/settings.json
- [ok] clsettings.json: Present
- /home/flyingbucket/.config/DankMaterialShell/clsettings.json
- [ok] plugin_settings.json: Present
- /home/flyingbucket/.config/DankMaterialShell/plugin_settings.json
- [ok] session.json: Present
- /home/flyingbucket/.local/state/DankMaterialShell/session.json
- [ok] dms-colors.json: Present
- /home/flyingbucket/.cache/DankMaterialShell/dms-colors.json

**Services**
- [ok] dms.service: enabled, active
- [ok] greetd: enabled

**Environment**
- [info] QT_QPA_PLATFORMTHEME: Not set
- [info] QS_ICON_THEME: Not set

---
**Summary:** 0 error(s), 0 warning(s), 33 ok

### Description

It seems quickshell is running under the xdm_t context, which is restricted from watching system-wide root and var directories.But dms doctor didn't report anything wrong. Maybe DMS needs these permissions for system monitoring components (like disk usage or mount events).

Here is the SELinux report:

Click to expand
SELinux is preventing qs from watch access on the directory /.

***** Plugin catchall (100. confidence) suggests **************************

If you believe that qs should be allowed watch access on the directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
`# ausearch -c 'qs' --raw | audit2allow -M my-qs`
`# semodule -X 300 -i my-qs.pp`

Additional Information:
Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context system_u:object_r:root_t:s0
Target Objects / [ dir ]
Source qs
Source Path qs
Port
Host
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-43.6-1.fc43.noarch
Local Policy RPM selinux-policy-targeted-43.6-1.fc43.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name MAGI
Platform Linux MAGI 6.19.11-200.fc43.x86_64 #1 SMP
PREEMPT_DYNAMIC Thu Apr 2 16:55:52 UTC 2026
x86_64
Alert Count 60
First Seen 2026-04-01 16:03:01 CST
Last Seen 2026-04-14 14:11:01 CST
Local ID 09e0a924-154b-46f9-ab0a-fec3b7d6fcda

Raw Audit Messages
type=AVC msg=audit(1776147061.414:245): avc: denied { watch } for pid=1646 comm="qs" path="/" dev="nvme0n1p3" ino=256 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=0

Hash: qs,xdm_t,root_t,dir,watch

### Expected Behavior

_No response_

### Steps to Reproduce

startup, login and run this command to check SELinux journals
`sudo sealert -a /var/log/audit/audit.log`

### Error Messages/Logs

_No response_

### Screenshots/Recordings

_No response_

Start by reproducing the denial during startup and login, then run `sudo sealert -a /var/log/audit/audit.log` and compare the reported `qs` access with DMS's system-monitoring behavior. Review the DMS Doctor entry point, `shell.qml`, and the `dms.service` configuration mentioned in the report. Done means establishing whether the access is required and defining a supported fix or an accurate diagnostic for the denial.

Written by the indexing model from the issue text.