workaround: #============= snapperd_t ============== allow snapperd_t cloud_init_t:dbus send_msg; but I think the fix should be in cloudform.te, with allowing snapper_dbus_chat (but I'm not a selinux policy specialist).