Description of problem:
When CA subsystem certificates on an IPA replica are being renewed (using certmonger component), the process fails due to AVC:

# getcert resubmit -d '/etc/pki/pki-tomcat/alias' -n 'auditSigningCert cert-pki-ca'Resubmitting "20140107045317" to "dogtag-ipa-retrieve-agent-submit".

# getcert list -d '/etc/pki/pki-tomcat/alias' -n 'auditSigningCert cert-pki-ca'Number of certificates and requests being tracked: 7.
Request ID '20140107045317':
	status: CA_UNREACHABLE     <<<<<<<<<
	stuck: yes
	key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin='783685401901'
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-retrieve-agent-submit
	issuer: CN=Certificate Authority,O=IDM.LAB.BOS.REDHAT.COM
	subject: CN=CA Audit,O=IDM.LAB.BOS.REDHAT.COM
	expires: 2015-12-28 05:00:43 UTC
	key usage: digitalSignature,nonRepudiation
	pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
	post-save command: /usr/lib64/ipa/certmonger/restart_pkicad "auditSigningCert cert-pki-ca"
	track: yes
	auto-renew: yes



/var/log/audit.log:
type=SYSCALL msg=audit(1389071271.605:211): arch=c000003e syscall=1 success=yes exit=3198461 a0=4 a1=7fcafa2b6010 a2=30cdfd a3=7fffa5473860 items=0 ppid=5380 pid=5383 auid=525 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1389071400.261:212): avc:  denied  { name_connect } for  pid=5417 comm="dogtag-ipa-retr" dest=389 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1389071400.261:212): arch=c000003e syscall=42 success=no exit=-13 a0=4 a1=3022280 a2=10 a3=0 items=0 ppid=5042 pid=5417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dogtag-ipa-retr" exe="/usr/bin/python2.7" subj=system_u:system_r:certmonger_t:s0 key=(null)

# tail /var/log/audit/audit.log | audit2allow 


#============= certmonger_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     nis_enabled, authlogin_nsswitch_use_ldap
allow certmonger_t ldap_port_t:tcp_socket name_connect;


When I added a SELinux module with this rule, the renewal worked.

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-112.el7.noarch
ipa-server-3.3.3-8.el7.x86_64
certmonger-0.70-1.el7.x86_64
pki-ca-10.0.5-3.el7.noarch
389-ds-base-1.3.1.6-13.el7.x86_64
How reproducible:


Steps to Reproduce:
1. Install IPA server
2. Install IPA replica with CA
3. Renew CA subsystem certificate on IPA master
4. Renew CA subsystem certificate on IPA replica (reads the one generated on master)

Actual results:
Step 4. fails due to AVC

Expected results:
Step 4 succeeds

Additional info:
Detailed reproduction scenario in Bug 1040009#c3.