Knowledge Base:Software installation fails with open wr ACCESS DENIED on SELinux systems

Synopsis
After upgrade of the SELinux userspace utilities (like libselinux and libsemanage), the installation process of any software fails with the following error message:

Environment
This error occurs on a SELinux-enabled Gentoo system, after updating the SELinux libselinux package towards version 2.1.9 or higher and with a Portage version prior to 2.1.10.56 or 2.2.0_alpha100:

Analysis
Since libselinux version 2.1.9 or higher, the standard location for the SELinux file system (selinuxfs) has moved from /selinux to /sys/fs/selinux. As a result, the sandbox integration in Portage, which allows read/write access to /selinux/context is now invalid (as it should point to /sys/fs/selinux/context). This has been fixed in recent versions of Portage, but these have not been stabilized when libselinux-2.1.9 was.

Resolution
Edit /etc/sandbox.conf and add in /sys/fs/selinux/context to the SANDBOX_WRITE parameter.

Further Resources

 * emerge fails with ACCESS DENIED on /sys/fs/selinux/context