Description of problem:

We have our zabbix monitoring user perform restarts of services when he detects that they are down.  During a recent mcollective restart we noticed that the selinux contexts had changed.  Here is what it looks like:

system_u:system_r:zabbix_agent_t:s0 (mcollective process)

Normally it is:

system_u:system_r:openshift_initrc_t:s0-s0:c0.c1023
OR
unconfined_u:system_r:openshift_initrc_t:s0-s0:c0.c1023

It appears that the service restart from zabbix needs to allow the transition back to the openshift context. 

Version-Release number of selected component (if applicable):
Current.

How reproducible:
Very in our environment.

Steps to Reproduce:
1.  As root, stop the mcollective service
2.  Zabbix will detect that mcollective is down and attempt to restart it.
3.  Once restarted it will have the new context.

Actual results:

Mcollective process now has zabbix_agent_t as a context.

Expected results:

Should return to openshift_initrc_t.

Additional info:

Please let me know if you need any information on this.  Excuse my ignorance when it comes to selinux but I believe we would like our policy to allow the zabbix user to restart services and for those services to transition back to their normal contexts.

I believe this is new as of RHEL 6.5