Description of problem:
SELinux is preventing pool-/usr/libex from 'write' accesses on the directory /var/lib/flatpak/repo/tmp.
***** Plugin catchall_labels (83.8 confidence) suggests *******************
If you want to allow libex to have write access on the tmp directory
Then you need to change the label on /var/lib/flatpak/repo/tmp
Do
# semanage fcontext -a -t FILE_TYPE '/var/lib/flatpak/repo/tmp'
where FILE_TYPE is one of the following: tmpfs_t.
Then execute:
restorecon -v '/var/lib/flatpak/repo/tmp'
***** Plugin catchall (17.1 confidence) suggests **************************
If you believe that libex should be allowed write access on the tmp directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'pool-/usr/libex' --raw | audit2allow -M my-poolusrlibex
# semodule -X 300 -i my-poolusrlibex.pp
Additional Information:
Source Context system_u:system_r:flatpak_helper_t:s0
Target Context system_u:object_r:var_lib_t:s0
Target Objects /var/lib/flatpak/repo/tmp [ dir ]
Source pool-/usr/libex
Source Path pool-/usr/libex
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-36.5-1.fc36.noarch
Local Policy RPM flatpak-selinux-1.12.7-1.fc36.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux (removed) 5.17.0-300.fc36.x86_64 #1 SMP
PREEMPT Wed Mar 23 22:00:40 UTC 2022 x86_64 x86_64
Alert Count 44
First Seen 2022-03-31 21:42:27 CEST
Last Seen 2022-03-31 21:47:27 CEST
Local ID 7aca6456-4fce-4752-b604-c2781bdf2cb1
Raw Audit Messages
type=AVC msg=audit(1648756047.892:1800): avc: denied { write } for pid=46399 comm="pool-/usr/libex" name="tmp" dev="dm-1" ino=1048795 scontext=system_u:system_r:flatpak_helper_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0
Hash: pool-/usr/libex,flatpak_helper_t,var_lib_t,dir,write
Version-Release number of selected component:
selinux-policy-targeted-36.5-1.fc36.noarch
Additional info:
component: flatpak
reporter: libreport-2.17.1
hashmarkername: setroubleshoot
kernel: 5.17.0-300.fc36.x86_64
type: libreport
Description of problem: SELinux is preventing pool-/usr/libex from 'write' accesses on the directory /var/lib/flatpak/repo/tmp. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow libex to have write access on the tmp directory Then you need to change the label on /var/lib/flatpak/repo/tmp Do # semanage fcontext -a -t FILE_TYPE '/var/lib/flatpak/repo/tmp' where FILE_TYPE is one of the following: tmpfs_t. Then execute: restorecon -v '/var/lib/flatpak/repo/tmp' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that libex should be allowed write access on the tmp directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'pool-/usr/libex' --raw | audit2allow -M my-poolusrlibex # semodule -X 300 -i my-poolusrlibex.pp Additional Information: Source Context system_u:system_r:flatpak_helper_t:s0 Target Context system_u:object_r:var_lib_t:s0 Target Objects /var/lib/flatpak/repo/tmp [ dir ] Source pool-/usr/libex Source Path pool-/usr/libex Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-36.5-1.fc36.noarch Local Policy RPM flatpak-selinux-1.12.7-1.fc36.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.17.0-300.fc36.x86_64 #1 SMP PREEMPT Wed Mar 23 22:00:40 UTC 2022 x86_64 x86_64 Alert Count 44 First Seen 2022-03-31 21:42:27 CEST Last Seen 2022-03-31 21:47:27 CEST Local ID 7aca6456-4fce-4752-b604-c2781bdf2cb1 Raw Audit Messages type=AVC msg=audit(1648756047.892:1800): avc: denied { write } for pid=46399 comm="pool-/usr/libex" name="tmp" dev="dm-1" ino=1048795 scontext=system_u:system_r:flatpak_helper_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 Hash: pool-/usr/libex,flatpak_helper_t,var_lib_t,dir,write Version-Release number of selected component: selinux-policy-targeted-36.5-1.fc36.noarch Additional info: component: flatpak reporter: libreport-2.17.1 hashmarkername: setroubleshoot kernel: 5.17.0-300.fc36.x86_64 type: libreport