Description of problem: SELinux is preventing usbmuxd from 'write' accesses on the directory /var/lib. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow usbmuxd to have write access on the lib directory Then you need to change the label on /var/lib Do # semanage fcontext -a -t FILE_TYPE '/var/lib' where FILE_TYPE is one of the following: usbmuxd_var_run_t, var_run_t. Then execute: restorecon -v '/var/lib' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that usbmuxd should be allowed write access on the lib directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep usbmuxd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:usbmuxd_t:s0 Target Context system_u:object_r:var_lib_t:s0 Target Objects /var/lib [ dir ] Source usbmuxd Source Path usbmuxd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages filesystem-3.2-27.fc21.x86_64 Policy RPM selinux-policy-3.13.1-76.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.16.1-300.fc21.x86_64 #1 SMP Thu Aug 14 15:06:34 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-08-28 21:32:17 CEST Last Seen 2014-08-28 21:32:17 CEST Local ID fb94e293-ff79-434a-964d-4cdc7f2900b4 Raw Audit Messages type=AVC msg=audit(1409254337.320:776): avc: denied { write } for pid=23748 comm="usbmuxd" name="lib" dev="dm-1" ino=1835030 scontext=system_u:system_r:usbmuxd_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 Hash: usbmuxd,usbmuxd_t,var_lib_t,dir,write Version-Release number of selected component: selinux-policy-3.13.1-76.fc21.noarch Additional info: reporter: libreport-2.2.3 hashmarkername: setroubleshoot kernel: 3.16.1-300.fc21.x86_64 type: libreport Potential duplicate: bug 1128403
*** Bug 1128403 has been marked as a duplicate of this bug. ***
It looks like it is trying to create /var/lib/lockdown?
3a052f6386734c686fb2bef3831d52369471975c adds support for this in git.
> It looks like it is trying to create /var/lib/lockdown? No idea. And if it does, I have no idea whether that's a good thing for it to be doing. :) To be honest, I only reported the bug against SELinux because that's what setroubleshoot allows. And I thought reporting it could start the conversation between the SELinux and usbmuxd people (I am not a part of either of these groups), to figure out if the policy needs to be relaxed or if usbmuxd should stop doing what it's doing. Now, if you think the policy needs to allow that, and it's done in Git, then great! :)
This is allowed in rawhide and F21.