Description of problem:
dnsmasq cannot start due to '/etc/dnsmasq.d: Permission denied'

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-103.el7.noarch
dnsmasq-2.66-10.el7.x86_64

How reproducible:
always

Steps to Reproduce:
# try to start dnsmasq service


[root@hp-dl380pgen8-02-vm-7 ~]# rpm -q dnsmasq
dnsmasq-2.66-10.el7.x86_64
[root@hp-dl380pgen8-02-vm-7 ~]# service dnsmasq start
Redirecting to /bin/systemctl start  dnsmasq.service
[root@hp-dl380pgen8-02-vm-7 ~]# service dnsmasq status
Redirecting to /bin/systemctl status  dnsmasq.service
dnsmasq.service - DNS caching server.
   Loaded: loaded (/usr/lib/systemd/system/dnsmasq.service; disabled)
   Active: failed (Result: exit-code) since Mon 2013-11-25 05:27:50 EST; 3s ago
  Process: 25132 ExecStart=/usr/sbin/dnsmasq -k (code=exited, status=3)
 Main PID: 25132 (code=exited, status=3)

Nov 25 05:27:50 hp-dl380pgen8-02-vm-7.lab.bos.redhat.com systemd[1]: Starting DNS caching server....
Nov 25 05:27:50 hp-dl380pgen8-02-vm-7.lab.bos.redhat.com systemd[1]: Started DNS caching server..
Nov 25 05:27:50 hp-dl380pgen8-02-vm-7.lab.bos.redhat.com dnsmasq[25132]: dnsmasq: cannot access directory /etc/dnsmasq.d: Permission denied
Nov 25 05:27:50 hp-dl380pgen8-02-vm-7.lab.bos.redhat.com systemd[1]: dnsmasq.service: main process exited, code=exited, status=3/NOTIMPLEMENTED
Nov 25 05:27:50 hp-dl380pgen8-02-vm-7.lab.bos.redhat.com systemd[1]: Unit dnsmasq.service entered failed state.
[root@hp-dl380pgen8-02-vm-7 ~]# cat /var/log/audit/audit.log | grep den
type=AVC msg=audit(1385375218.314:84): avc:  denied  { read } for  pid=9385 comm="dnsmasq" name="dnsmasq.d" dev="dm-1" ino=67823317 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:dnsmasq_etc_t:s0 tclass=dir
type=AVC msg=audit(1385375226.164:87): avc:  denied  { read } for  pid=11707 comm="dnsmasq" name="dnsmasq.d" dev="dm-1" ino=67823317 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:dnsmasq_etc_t:s0 tclass=dir
type=AVC msg=audit(1385375270.734:90): avc:  denied  { read } for  pid=25132 comm="dnsmasq" name="dnsmasq.d" dev="dm-1" ino=67823317 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:dnsmasq_etc_t:s0 tclass=dir

### then I did setenforce 0:

type=MAC_STATUS msg=audit(1385375348.652:92): enforcing=0 old_enforcing=1 auid=0 ses=2
type=SYSCALL msg=audit(1385375348.652:92): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff49229a60 a2=1 a3=7fff49229820 items=0 ppid=9316 pid=25146 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=USER_AVC msg=audit(1385375351.348:93): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=0)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=SERVICE_START msg=audit(1385375353.171:94): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="dnsmasq" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1385375353.174:95): avc:  denied  { read } for  pid=25170 comm="dnsmasq" name="dnsmasq.d" dev="dm-1" ino=67823317 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=system_u:object_r:dnsmasq_etc_t:s0 tclass=dir
type=SYSCALL msg=audit(1385375353.174:95): arch=c000003e syscall=257 success=yes exit=4 a0=ffffffffffffff9c a1=7fd6456c7e10 a2=90800 a3=0 items=0 ppid=1 pid=25170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dnsmasq" exe="/usr/sbin/dnsmasq" subj=system_u:system_r:dnsmasq_t:s0 key=(null)


Actual results:
avc denial and service cannot be started

Expected results:
no denial

Additional info: