Comment # 15 on bug 1199520 from Filippo Bonazzi

This confirms that the issue is the system being mislabeled/unlabeled. You can
see e.g. that the target context for /usr/bin/bash is
unconfined_u:unconfined_r:unconfined_t:s0 (should be something like
system_u:object_r:shell_exec_t:s0).

The solution is to have the snapshot system properly set the labels on the
filesystem (using restorecon, or autorelabel, ...) before it is set to RO. I
don't know how to do this, because this is entirely within the realm of the
transactional server.