Bug 1417671

Description of problem:
We use the a 3rd party software called OpenAFS (http://www.openafs.org) to access home directories in AFS.  There already is policy added for support of using AFS (so everything is correctly labelled), however, I've discovered that the existing AFS policy needs to be updated to allow SELinux confined users to acquire AFS Tokens.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.13.noarch

How reproducible:
Always

Steps to Reproduce:
1. Install openafs software, I build my own repos here:
https://copr.fedorainfracloud.org/coprs/jsbillings/openafs/builds/
Note: this requires a working AFS cell and kerberos realm.
2. Set up a user that is confined and has an AFS account:
semanage login -a -s user_u myuser
3. Try to run 'aklog' as myuser

Actual results:
$ aklog
aklog: can't get afs configuration (afsconf_Open(/etc/openafs))


Expected results:
'aklog' should get AFS tokens from my kerberos tickets.

Additional info:

Here are the Audit logs for when I run aklog (permissive with dontaudit off):

type=AVC msg=audit(1485791285.432:1496): avc:  denied  { open } for  pid=3747 comm="aklog" path="/etc/openafs/ThisCell" dev="dm-0" ino=3408589 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:afs_config_t:s0 tclass=file
type=AVC msg=audit(1485791285.432:1496): avc:  denied  { read } for  pid=3747 comm="aklog" name="ThisCell" dev="dm-0" ino=3408589 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:afs_config_t:s0 tclass=file

type=AVC msg=audit(1485791285.438:1498): avc:  denied  { open } for  pid=3747 comm="aklog" path="/proc/fs/openafs/afs_ioctl" dev="proc" ino=4026532171 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:proc_afs_t:s0 tclass=file
type=AVC msg=audit(1485791285.438:1498): avc:  denied  { read } for  pid=3747 comm="aklog" name="afs_ioctl" dev="proc" ino=4026532171 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:proc_afs_t:s0 tclass=file


I have a working SELinux module that addresses this problem.

$ cat afsusers.te 
policy_module(afsusers,1.0.0)
gen_require(` type staff_t, user_t; ')
gen_require(` type proc_afs_t; ')
read_files_pattern({ staff_t user_t}, proc_afs_t, proc_afs_t)
afs_read_config(staff_t)
afs_read_config(user_t)

Loading the module lets 'aklog' read /etc/openafs/ThisCell as well as /proc/fs/openafs/afs_ioctl.