Bug 1337319

Description of problem:
missing rhsmcertd_t attribute (from subscription-manager)

Noticed this while running satellite 6.1.9 server, freshly installed.

From /var/log/messages;

May 18 21:55:07 hostname setroubleshoot: SELinux is preventing /usr/bin/python2.7 from name_connect access on the tcp_socket port 9090. For complete SELinux messages. run sealert -l c1238a23-821d-43d7-94fe-e4838529ee3d
May 18 21:55:07 hostname python: SELinux is preventing /usr/bin/python2.7 from name_connect access on the tcp_socket port 9090.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that python2.7 should be allowed name_connect access on the port 9090 tcp_socket by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# grep rhsmcertd-worke /var/log/audit/audit.log | audit2allow -M mypol#012# semodule -i mypol.pp#012

Checking and creating module:

# grep rhsmcertd-worke /var/log/audit/audit.log | audit2allow
#============= rhsmcertd_t ==============
allow rhsmcertd_t websm_port_t:tcp_socket name_connect;

Inserting module gives;

# semodule -i rhsmcertd.pp
libsepol.print_missing_requirements: rhsmcertd's global requirements were not met: type/attribute rhsmcertd_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!


Version-Release number of selected component (if applicable):

# rpm -qa | grep -E 'redhat-release|subscription-manager|selinux-policy'
redhat-release-server-7.2-9.el7.x86_64
subscription-manager-1.15.9-15.el7.x86_64
selinux-policy-targeted-3.13.1-60.el7_2.3.noarch
selinux-policy-3.13.1-60.el7_2.3.noarch


How reproducible:

100% spamming /var/log/messages in a timely manner, every 4 hours.

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: