Description of problem:

Can't start arpwatch on fc22.  Worked fine on fc21 and prior.

Version-Release number of selected component (if applicable):

arpwatch-2.1a15-33.fc22.i686
arpwatch-2.1a15-33.fc22.x86_64

How reproducible:

100%

Steps to Reproduce:
1. systemctl start arpwatch
2. Job for arpwatch.service failed. See "systemctl status arpwatch.service" and "journalctl -xe" for details.
3. inspection shows it not running

Actual results:

# systemctl start arpwatch
Job for arpwatch.service failed. See "systemctl status arpwatch.service" and "journalctl -xe" for details.

# systemctl status arpwatch.service
* arpwatch.service - Arpwatch daemon which keeps track of ethernet/ip address pairings
   Loaded: loaded (/usr/lib/systemd/system/arpwatch.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2015-11-15 02:50:18 UTC; 7s ago
     Docs: man:arpwatch
  Process: 2933 ExecStart=/usr/sbin/arpwatch -u arpwatch -e root -s root (Arpwatch) (code=exited, status=1/FAILURE)

Nov 15 02:50:18 HOST systemd[1]: Starting Arpwatch daemon which keeps track of ethernet/ip address pairings...
Nov 15 02:50:18 HOST arpwatch[2933]: arpwatch: lookup_device: Can't open netlink socket 13:Permission denied
Nov 15 02:50:18 HOST systemd[1]: arpwatch.service: control process exited, code=exited status=1
Nov 15 02:50:18 HOST systemd[1]: Failed to start Arpwatch daemon which keeps track of ethernet/ip address pairings.
Nov 15 02:50:18 HOST systemd[1]: Unit arpwatch.service entered failed state.
Nov 15 02:50:18 HOST systemd[1]: arpwatch.service failed.

journlctl -xe tail...

-- Unit arpwatch.service has begun starting up.
Nov 15 03:05:51 HOST audit[3222]: <audit-1400> avc:  denied  { create } for  pid=322
2 comm="arpwatch" scontext=system_u:system_r:arpwatch_
Nov 15 03:05:51 HOST audit[3222]: <audit-1300> arch=40000003 syscall=102 success=no
exit=-13 a0=1 a1=bfa088f0 a2=b7799000 a3=bfa08a0c item
Nov 15 03:05:51 HOST audit: <audit-1327> proctitle=2F7573722F7362696E2F6172707761746
368002D75006172707761746368002D6500726F6F74002D7300726
Nov 15 03:05:51 HOST arpwatch[3222]: arpwatch: lookup_device: Can't open netlink soc
ket 13:Permission denied
Nov 15 03:05:51 HOST systemd[1]: arpwatch.service: control process exited, code=exit
ed status=1
Nov 15 03:05:51 HOST systemd[1]: Failed to start Arpwatch daemon which keeps track o
f ethernet/ip address pairings.
-- Subject: Unit arpwatch.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit arpwatch.service has failed.
-- 
-- The result is failed.
Nov 15 03:05:51 HOST systemd[1]: Unit arpwatch.service entered failed state.
Nov 15 03:05:51 HOST systemd[1]: arpwatch.service failed.
Nov 15 03:05:51 HOST audit[1]: <audit-1130> pid=1 uid=0 auid=4294967295 ses=42949672
95 subj=system_u:system_r:init_t:s0 msg='unit=arpwatch
Nov 15 03:05:51 HOST polkitd[3100]: Unregistered Authentication Agent for unix-proce
ss:3217:16401885 (system bus name :1.599, object path



Expected results:

running


Additional info:

# restorecon -Rv /var/lib/arpwatch
(no output; just checking...)


Tried selinux permit... (this usually works but not this time)


# grep arpwatch /var/log/audit/audit.log | tail -5
type=SYSCALL msg=audit(1447555818.381:3620): arch=40000003 syscall=102 success=no exit=-13 a0=1 a1=bfb03330 a2=b77a8000 a3=bfb0344c items=0 ppid=1 pid=2933 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="arpwatch" exe="/usr/sbin/arpwatch" subj=system_u:system_r:arpwatch_t:s0 key=(null)
type=SERVICE_START msg=audit(1447555818.399:3621): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=arpwatch comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=AVC msg=audit(1447556122.571:3622): avc:  denied  { create } for  pid=2994 comm="arpwatch" scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:system_r:arpwatch_t:s0 tclass=netlink_netfilter_socket permissive=0
type=SYSCALL msg=audit(1447556122.571:3622): arch=40000003 syscall=102 success=no exit=-13 a0=1 a1=bffc5530 a2=b76de000 a3=bffc564c items=0 ppid=1 pid=2994 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="arpwatch" exe="/usr/sbin/arpwatch" subj=system_u:system_r:arpwatch_t:s0 key=(null)
type=SERVICE_START msg=audit(1447556122.585:3623): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=arpwatch comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'

# grep arpwatch /var/log/audit/audit.log | tail -5 |audit2allow -M arpwatch
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i arpwatch.pp

# semodule -i arpwatch.pp
libsepol.print_missing_requirements: arpwatch's global requirements were not met: type/attribute arpwatch_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!

# cat arpwatch.te

module arpwatch 1.0;

require {
        type arpwatch_t;
        class netlink_netfilter_socket create;
}

#============= arpwatch_t ==============
allow arpwatch_t self:netlink_netfilter_socket create;



These systems were yum upgraded from fc21 using distro-sync, and I've done a 'dnf reinstall arpwatch'
just to be sure...