Description of problem:
systemd-sysctl lacks adequate allowances in selinux-targeted-policy for it to do its job.

systemctl --failed shows it to have failed; checking the audit log, we see that it failed as a result of lacking access to the "sys_rawio" capability.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.12.1-183.fc20.noarch

How reproducible:
systemctl restart systemd-sysctl on a Fedora 20 system having kernel kernel-3.15.10-201.fc20.x86_64 and custom sysctl values in a file under /etc/sysctl.d

Steps to Reproduce:
1. Ensure that you have a set of custom sysctl values in a file under /etc/sysctl.d
2. Run systemctl restart systemd-sysctl
3. Note that systemd-sysctl will appear to have failed. Audit log will show that this is due to sys_rawio capability being missing.

Using audit2allow to add the following module:
module systemd-sysctl-fix 1.0;

require {
        type systemd_sysctl_t;
        class capability sys_rawio;
}

#============= systemd_sysctl_t ==============
allow systemd_sysctl_t self:capability sys_rawio;

resolves the issue.

Actual results:
systemd-sysctl unable to apply custom sysctl values.


Expected results:
systemd-sysctl should run successfully.

Additional info: