This bug is reported against selinux-policy-targeted-3.13.1-128.10.fc22.noarch.

lircd can be configured to run as a low-privilege user through its --effective-user command-line option or effective-user config option. This is thwarted by the current SELinux targeted policy on F22, however, as it does not permit lircd to read /etc/passwd and /etc/group or call setuid() and setgid(). lircd continues to run as the root user if SELinux is enforcing.

The log message from lircd is:

  lircd-0.9.2a[15384]: Illegal effective uid: lirc: Permission denied

This is from its attempt to call getpwnam on the username "lirc" (i.e. reading /etc/passwd).

My workaround is the following custom policy:

  policy_module(my_lircd, 1.0.0)

  gen_require(`
      type lircd_t;
  ')

  auth_read_passwd(lircd_t)
  allow lircd_t self:capability { setuid setgid };

setgid() isn't used by lirc 0.9.2, but it will be by lirc 0.9.3.