Fix SELinux backup execution context and probe source metadata before downtime

systemd/app-backup.service

@@ -5,7 +5,14 @@ After=network-online.target
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/sbin/app-backup.sh
+# Bash is an allowed entry point for this SELinux service domain. Running rsync
+# directly as the entry point can fail even when child execution is permitted.
+ExecStart=/bin/bash /usr/local/sbin/app-backup.sh
+# A privileged backup crosses web/mail/user labels and preserves those labels.
+# Keep enforcing globally; scope unconfined execution to this backup service.
+# This deliberately removes SELinux confinement for this unit and its children.
+# No '-' prefix: an unavailable/denied context must fail visibly.
+SELinuxContext=system_u:system_r:unconfined_service_t:s0
 # Timeout sends TERM: Bash runs its recovery trap; grace time permits service restart.
 TimeoutStartSec=12h
 TimeoutStopSec=5min