Bug 1303644

Description of problem:
 * there are 2 booleans which allow setrlimit operation (httpd_setrlimit and zarafa_setrlimit) but the base.pp contains an allow rule which allows all domains to do setrlimit

Version-Release number of selected component (if applicable):
selinux-policy-devel-3.13.1-60.el7.noarch
selinux-policy-minimum-3.13.1-60.el7.noarch
selinux-policy-mls-3.13.1-60.el7.noarch
selinux-policy-sandbox-3.13.1-60.el7.noarch
selinux-policy-targeted-3.13.1-60.el7.noarch
selinux-policy-3.13.1-60.el7.noarch
selinux-policy-doc-3.13.1-60.el7.noarch

How reproducible:
always

Steps to Reproduce:
# find /etc/selinux/targeted/ -name base.pp
/etc/selinux/targeted/modules/active/base.pp
# cp `find /etc/selinux/targeted/ -name base.pp` .
# mv base.pp base.pp.bz2
# bzip2 -d base.pp.bz2 
# sedismod base.pp 
Reading policy...
libsepol.policydb_index_others: security:  5 users, 6 roles, 1323 types, 25 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security:  83 classes, 0 rules, 0 cond rules
libsepol.policydb_index_others: security:  5 users, 6 roles, 1323 types, 25 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security:  83 classes, 0 rules, 0 cond rules
Binary base policy file loaded.

Select a command:
1)  display unconditional AVTAB
2)  display conditional AVTAB
3)  display users
4)  display bools
5)  display roles
6)  display types, attributes, and aliases
7)  display role transitions
8)  display role allows
9)  Display policycon
0)  Display initial SIDs
a)  Display avrule requirements
b)  Display avrule declarations
c)  Display policy capabilities
l)  Link in a module
u)  Display the unknown handling setting
F)  Display filename_trans rules
f)  set output file
m)  display menu
q)  quit

Command ('m' for menu):  f

Filename for output (<CR> for screen output): output.txt

Output to file: output.txt

Command ('m' for menu):  1

Command ('m' for menu):  q
# grep "allow domain.*setrlimit" output.txt 
  allow domain self : process { fork sigchld sigkill sigstop signull signal getsched getsession getcap getattr setrlimit };
#

Expected results:
 * either both booleans are redundant or the above-mentioned rule should not contain the setrlimit permission

Additional info:
 * more than 700 domains is allowed to do setrlimit

# sesearch -c process -p setrlimit -A -C | grep -v '\[' | wc -l
798
#