SELinux policy denials on MicroOS (snapper/systemd)