Description of problem:
We are using SELinux to contain processes with least privilege access to the OS file system. All this processes run as a (domain) type which is included in the "domain" attribute, as it is good practice for every domain type. After the update from RHEL 6.6 to 6.7 we saw that our processes are able to read files and directories labeled with "bin_t" (and other). The reason is that a directive was added to allow the attribute "domain" to read all files labeled as "base_ro_file_type":

problematic directives, added with policy-RHEL6.7-e2506.patch
----------
   allow domain base_ro_file_type : file { ioctl read getattr lock open } ; 
   allow domain base_ro_file_type : dir { ioctl read getattr lock search open } ; 
----------

"base_ro_file_type" consists of many common resource types like bin_t, etc_t, usr_t, system_conf_t, this allows all processes to examine a large part of the OS file system, what we consider as a decrease in security.
Our problem now is, since the directive adds these permissions to the "root" attribute "domain" it is not possible to create a domain type that does not have this privileges. In our mind this privileges should have been given to a sub attribute/type of "domain" and not "domain" itself.


Version-Release number of selected component (if applicable): 
selinux-policy-minimum-3.7.19-279.el6_7.7.noarch


How reproducible:
compare results between 6.6 and 6.7
sesearch --allow -s domain -t bin_t -p read | grep "allow domain"


Actual results:
   allow domain base_ro_file_type : file { ioctl read getattr lock open } ; 
   allow domain base_ro_file_type : dir { ioctl read getattr lock search open } ; 
   allow domain base_ro_file_type : lnk_file { read getattr } ;

Expected results:
[empty]

Additional info: