Description of problem: SELinux is preventing pool-/usr/libex from 'write' accesses on the directory /var/lib/flatpak/repo/tmp. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow libex to have write access on the tmp directory Then you need to change the label on /var/lib/flatpak/repo/tmp Do # semanage fcontext -a -t FILE_TYPE '/var/lib/flatpak/repo/tmp' where FILE_TYPE is one of the following: tmpfs_t. Then execute: restorecon -v '/var/lib/flatpak/repo/tmp' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that libex should be allowed write access on the tmp directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'pool-/usr/libex' --raw | audit2allow -M my-poolusrlibex # semodule -X 300 -i my-poolusrlibex.pp Additional Information: Source Context system_u:system_r:flatpak_helper_t:s0 Target Context system_u:object_r:var_lib_t:s0 Target Objects /var/lib/flatpak/repo/tmp [ dir ] Source pool-/usr/libex Source Path pool-/usr/libex Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-36.5-1.fc36.noarch Local Policy RPM flatpak-selinux-1.12.7-1.fc36.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.17.0-300.fc36.x86_64 #1 SMP PREEMPT Wed Mar 23 22:00:40 UTC 2022 x86_64 x86_64 Alert Count 44 First Seen 2022-03-31 21:42:27 CEST Last Seen 2022-03-31 21:47:27 CEST Local ID 7aca6456-4fce-4752-b604-c2781bdf2cb1 Raw Audit Messages type=AVC msg=audit(1648756047.892:1800): avc: denied { write } for pid=46399 comm="pool-/usr/libex" name="tmp" dev="dm-1" ino=1048795 scontext=system_u:system_r:flatpak_helper_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 Hash: pool-/usr/libex,flatpak_helper_t,var_lib_t,dir,write Version-Release number of selected component: selinux-policy-targeted-36.5-1.fc36.noarch Additional info: component: flatpak reporter: libreport-2.17.1 hashmarkername: setroubleshoot kernel: 5.17.0-300.fc36.x86_64 type: libreport
I suspect that this is the same as bug 2070741 My apologies if I got it wrong. *** This bug has been marked as a duplicate of bug 2070741 ***