Description of problem:
SELinux is preventing polkitd from 'connectto' accesses on the unix_stream_socket /var/lib/sss/pipes/nss.

*****  Plugin catchall (100. confidence) suggests   **************************

If вы считаете, что polkitd следует разрешить доступ connectto к nss unix_stream_socket по умолчанию.
Then рекомендуется создать отчет об ошибке.
Чтобы разрешить доступ, можно создать локальный модуль политики.
Do
allow this access for now by executing:
# ausearch -c 'polkitd' --raw | audit2allow -M my-polkitd
# semodule -X 300 -i my-polkitd.pp

Additional Information:
Source Context                system_u:system_r:policykit_t:s0
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                /var/lib/sss/pipes/nss [ unix_stream_socket ]
Source                        polkitd
Source Path                   polkitd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-224.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.8.8-300.fc25.x86_64 #1 SMP Tue
                              Nov 15 18:10:06 UTC 2016 x86_64 x86_64
Alert Count                   16
First Seen                    2016-11-26 04:54:19 MSK
Last Seen                     2016-11-26 05:09:10 MSK
Local ID                      ab70033a-cb3d-462d-8a63-07e25ce5b9fa

Raw Audit Messages
type=AVC msg=audit(1480126150.571:456): avc:  denied  { connectto } for  pid=868 comm="polkitd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:policykit_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0


Hash: polkitd,policykit_t,unconfined_t,unix_stream_socket,connectto

Version-Release number of selected component:
selinux-policy-3.13.1-224.fc25.noarch

Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.10-300.fc25.x86_64
type:           libreport