Bug 1545230

Description of problem:
Certmonger can be configured to send notifications about certificates that are going to expire soon either via syslog or mail. While the syslog-based configuration works without any problems, certmonger can not send emails with SELinux in enforcing mode.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-189.el7.noarch
certmonger-0.78.4-3.el7.x86_64

How reproducible:
- Configure certmonger to send notifications via email:

# grep -v '^#' /etc/certmonger/certmonger.conf 
[defaults]
notification_method = mail 
notification_destination = root

- Change system date so that a certificate that is tracked by certmonger is going to expire soon (e.g. 10 days before the actual expiration)

Steps to Reproduce:
1.
2.
3.

Actual results:
certmonger does not send an email alert because of SELinux AVC denials.

Expected results:
certmonger is supposed to send an email alert.

Additional info:
# grep AVC /var/log/audit/audit.log |audit2allow 

#============= certmonger_t ==============
allow certmonger_t etc_mail_t:dir getattr;
allow certmonger_t etc_mail_t:file { getattr open read };
allow certmonger_t fs_t:filesystem getattr;
allow certmonger_t mqueue_spool_t:dir { add_name getattr open read remove_name search write };
allow certmonger_t mqueue_spool_t:file { create getattr lock open read unlink write };
allow certmonger_t self:process setrlimit;
allow certmonger_t sendmail_exec_t:file { execute execute_no_trans open read };

#!!!! This avc can be allowed using the boolean 'nis_enabled'
allow certmonger_t smtp_port_t:tcp_socket name_connect;