selocal is unable to load the policy in enforcing mode because semodule doesn't have permission to read /root/.selocal/selocal.pp. Reproducible: Always Steps to Reproduce: 1. setenforce 1 2. selocal -bL Actual Results: ## Loading selocal.pp (in ~/.selocal): # semodule -i ~/.selocal/selocal.pp libsemanage.map_file: Unable to open /root/.selocal/selocal.pp (Permission denied). libsemanage.semanage_direct_install_file: Unable to read file /root/.selocal/selocal.pp (Permission denied). semodule: Failed on /root/.selocal/selocal.pp! type=AVC msg=audit(1655717414.885:20): avc: denied { search } for pid=7779 comm="semodule" name="root" dev="sda2" ino=74160 scontext=unconfined_u:unconfined_r:semanage_t tcontext=system_u:object_r:default_t tclass=dir permissive=1 type=AVC msg=audit(1655717414.885:20): avc: denied { read } for pid=7779 comm="semodule" name="selocal.pp" dev="sda2" ino=1995777 scontext=unconfined_u:unconfined_r:semanage_t tcontext=system_u:object_r:default_t tclass=file permissive=1 type=AVC msg=audit(1655717414.885:20): avc: denied { open } for pid=7779 comm="semodule" path="/root/.selocal/selocal.pp" dev="sda2" ino=1995777 scontext=unconfined_u:unconfined_r:semanage_t tcontext=system_u:object_r:default_t tclass=file permissive=1 type=AVC msg=audit(1655717414.886:21): avc: denied { getattr } for pid=7779 comm="semodule" path="/root/.selocal/selocal.pp" dev="sda2" ino=1995777 scontext=unconfined_u:unconfined_r:semanage_t tcontext=system_u:object_r:default_t tclass=file permissive=1 type=AVC msg=audit(1655717414.886:22): avc: denied { map } for pid=7779 comm="semodule" path="/root/.selocal/selocal.pp" dev="sda2" ino=1995777 scontext=unconfined_u:unconfined_r:semanage_t tcontext=system_u:object_r:default_t tclass=file permissive=1
Your system looks to be mislabeled. /root is supposed to be labeled 'user_home_dir_t' and its contents 'user_home_t'. Try issuing 'restorecon -RFv /root' and see if that resolves the issue.
Running that command with SELINUXTYPE=targeted (which I'm using) keeps /root labeled as default_t, but if I change it to strict, it does label it correctly.
