OpenVPN allows one to use socket files for the management interface instead of TCP ports. This is important in servers where non-admin users are also allowed to SSH in, because limits their access to the management interface.

Example directive:
management /var/run/openvpn/management-tcp unix
management-client-user root

However there is no SELinux rule in RHEL7 that allows creation of such socket file, so I had to create one by my own:

***
module ovpn 1.0;

require {
  type openvpn_t;
  type openvpn_var_run_t;
  class sock_file { create read write unlink };
}

#============= openvpn_t ==============
allow openvpn_t openvpn_var_run_t:sock_file { create read write unlink };
***

I wonder if it would be possible to integrate this into the package shipped in the EPEL repo.