Description of problem:
SELinux policy prevents systemd service strongswan.service from starting up, whereas running '/usr/sbin/strongswan start --nofork' manually does work fine.

Version-Release number of selected component (if applicable):
3.11.1-100

How reproducible:
Always

Steps to reproduce:
1. yum install strongswan
2. set up the strongswan configuration, etc
3. systemctl start strongswan.service

Actual results:
Fails to start with these messages in the audit log:
type=AVC msg=audit(1378053671.755:1425): avc:  denied  { unlink } for  pid=6597 comm="starter" name="charon.ctl" dev="tmpfs" ino=47153 scontext=system_u:system_r:ipsec_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1378053671.757:1426): avc:  denied  { execute_no_trans } for  pid=6606 comm="starter" path="/usr/libexec/strongswan/charon" dev="xvda2" ino=416998 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:ipsec_exec_t:s0 tclass=file

Expected results:
It should just work through systemctl with no denials.

Additional info:
I tried 'fixfiles -R strongswan restore' but it did not help.
I proceeded to create a semodule after which the denials were of course gone.
FYI, the output of the generated .te file is:
module strongswan 1.0;

require {
        type ipsec_t;
        type var_run_t;
        type ipsec_exec_t;
        class sock_file unlink;
        class file execute_no_trans;
}

#============= ipsec_t ==============
allow ipsec_t ipsec_exec_t:file execute_no_trans;
allow ipsec_t var_run_t:sock_file unlink;