Description of problem:

Using osad on CentOS 7 logs several AVC and prevents it from working. Most AVCs look similar to the ones introduced with CentOS 6.6 (See #1161288).
The following AVCs are logged on osad startup:

time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8509): arch=c000003e syscall=2 success=yes exit=3 a0=7fa84d9ed3a7 a1=80000 a2=1b6 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8509): avc:  denied  { open } for  pid=9844 comm="osad" path="/etc/resolv.conf" dev="dm-0" ino=17018233 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
type=AVC msg=audit(1423066572.058:8509): avc:  denied  { read } for  pid=9844 comm="osad" name="resolv.conf" dev="dm-0" ino=17018233 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8510): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7fff6641bba0 a2=7fff6641bba0 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8510): avc:  denied  { getattr } for  pid=9844 comm="osad" path="/etc/resolv.conf" dev="dm-0" ino=17018233 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8511): arch=c000003e syscall=41 success=yes exit=3 a0=2 a1=1 a2=6 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8511): avc:  denied  { create } for  pid=9844 comm="osad" scontext=system_u:system_r:osad_t:s0 tcontext=system_u:system_r:osad_t:s0 tclass=tcp_socket
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.058:8512): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff6641ded0 a2=10 a3=0 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.058:8512): avc:  denied  { name_connect } for  pid=9844 comm="osad" dest=443 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1423066572.058:8512): avc:  denied  { connect } for  pid=9844 comm="osad" scontext=system_u:system_r:osad_t:s0 tcontext=system_u:system_r:osad_t:s0 tclass=tcp_socket
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.573:8513): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff6641e530 a2=10 a3=3 items=0 ppid=9843 pid=9844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.573:8513): avc:  denied  { name_connect } for  pid=9844 comm="osad" dest=5222 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:object_r:jabber_client_port_t:s0 tclass=tcp_socket
----
time->Wed Feb  4 17:16:12 2015
type=SYSCALL msg=audit(1423066572.625:8517): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=1 a2=9 a3=7fff6641ee5c items=0 ppid=1 pid=9845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="osad" exe="/usr/bin/python2.7" subj=system_u:system_r:osad_t:s0 key=(null)
type=AVC msg=audit(1423066572.625:8517): avc:  denied  { setopt } for  pid=9845 comm="osad" laddr=1.2.3.212 lport=49717 faddr=1.2.3.212 fport=5222 scontext=system_u:system_r:osad_t:s0 tcontext=system_u:system_r:osad_t:s0 tclass=tcp_socket

Backporting some changes from rawhide selinux-policy makes osad work. Scheduling package updates work and osad ping works, too.

The following local policy fixes the issues:

policy_module(osad-selinux,1.0)

require {
        type jabber_client_port_t;
        type osad_t;
}

corenet_tcp_connect_http_port(osad_t)
corenet_tcp_connect_jabber_client_port(osad_t)

corecmd_exec_bin(osad_t)

dev_read_urand(osad_t)

auth_use_nsswitch(osad_t)
optional_policy(`
    rpm_domtrans(osad_t)
')

Maybe less permissions are needed, but due to unavailability of an selinux-policy package from RHEL 7.1, I was unable to check, whether the issues were already addressed in newer policy.

Version-Release number of selected component (if applicable):

On CentOS 7.0:
selinux-policy-3.12.1-153.el7_0.13
osad-5.11.52-1.el7

How reproducible:

Always

Steps to Reproduce:
1. Install osad
2. Start osad

Actual results:

osad fails to start and AVCs are logged

Expected results:

osad starts up and works

Additional info: