Output from comment 0 is from journal, on the terminal, the output is along the lines of:

Configuring DNS key synchronization service (ipa-dnskeysyncd)
  [1/7]: checking status
  [2/7]: setting up bind-dyndb-ldap working directory
  [3/7]: setting up kerberos principal
  [4/7]: setting up SoftHSM
  [5/7]: adding DNSSEC containers
  [6/7]: creating replica keys
  [7/7]: configuring ipa-dnskeysyncd to start on boot
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
ipa         : ERROR    Named service failed to start (Command '/bin/systemctl restart named-pkcs11.service' returned non-zero exit status 1)
named service failed to start
Updating DNS system records
ipa         : ERROR    DNS query for qe-blade-12.testrelm.test. 1 failed: The DNS operation timed out after 30.0008788109 seconds
ipa         : ERROR    DNS query for qe-blade-12.testrelm.test. 1 failed: The DNS operation timed out after 30.0003278255 seconds
ipa         : ERROR    DNS query for qe-blade-12.testrelm.test. 1 failed: The DNS operation timed out after 30.000426054 seconds
ipa         : ERROR    DNS query for qe-blade-12.testrelm.test. 1 failed: The DNS operation timed out after 30.0010049343 seconds
ipa         : ERROR    unable to resolve host name qe-blade-12.testrelm.test. to IP address, ipa-ca DNS record will be incomplete
Restarting the web server

This is very likely caused by SELinux policy. Feel free to re-open if it does not work even in permissive mode.

*** This bug has been marked as a duplicate of bug 1350957 ***

The AVC denials that we see here are about dogtag-ipa-ca-r, certmonger_t, and log and not about named-pkcs11, named_t, and tokens as listed in bug 1350957. Also, in bug 1350957, ipa-server-install presumably passed because that bug is about ipactl start. Here we are not even able to get the IPA server configured.

So I'm not sure this should be closed as duplicate without investigating that it really is a dupe. Therefore, reopening.

Okay then, please provide exact steps including command line options / answers for interactive mode you used for installation + version of selinux policy you have installed.

Thanks.

I've wasted some time on this and I it is really a dupe as mentioned in comment #5.

Parameters I used:

DEBUG ipa-server-install was invoked with arguments [] and options: {'no_dns_sshfp': None, 'ignore_topology_disconnect': None, 'verbose': False, 'ip_addresses': None, 'domainlevel': None, 'mkhomedir': None, 'http_cert_files': None, 'no_ntp': None, 'reverse_zones': None, 'no_forwarders': None, 'external_ca_type': None, 'ssh_trust_dns': None, 'domain_name': 'dom-040.abc.idm.lab.eng.brq.redhat.com', 'idmax': None, 'http_cert_name': None, 'dirsrv_cert_files': None, 'no_dnssec_validation': None, 'ca_signing_algorithm': None, 'no_reverse': None, 'subject': None, 'unattended': True, 'auto_reverse': None, 'auto_forwarders': True, 'no_host_dns': None, 'no_sshd': None, 'no_ui_redirect': None, 'ignore_last_of_role': None, 'realm_name': 'DOM-040.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM', 'forwarders': None, 'idstart': None, 'external_ca': None, 'no_ssh': None, 'external_cert_files': None, 'no_hbac_allow': None, 'forward_policy': None, 'dirsrv_cert_name': None, 'ca_cert_files': None, 'zonemgr': None, 'quiet': False, 'setup_dns': True, 'host_name': None, 'dirsrv_config_file': None, 'log_file': None, 'allow_zone_overlap': None, 'uninstall': False}

The error in console is the very same (as long as --setup-dns is used).
The installation finished in exactly same manner as it did in bug description.
It works when I switch system to permissive mode.

My audit.log from permissive mode contains this:

type=AVC msg=audit(1467976092.551:664): avc:  denied  { read } for  pid=21031 comm="named-pkcs11" name="tokens" dev="dm-0" ino=8968869 scontext=system_u:system_r:named_t:s0 tcontext=unconfined_u:object_r:ipa_var_lib_t:s0 tclass=dir
type=AVC msg=audit(1467976092.551:665): avc:  denied  { read write } for  pid=21031 comm="named-pkcs11" name="generation" dev="dm-0" ino=17388914 scontext=system_u:system_r:named_t:s0 tcontext=unconfined_u:object_r:ipa_var_lib_t:s0 tclass=file
type=AVC msg=audit(1467976092.551:665): avc:  denied  { open } for  pid=21031 comm="named-pkcs11" path="/var/lib/ipa/dnssec/tokens/e44b3d63-08ff-e576-3086-6c51eec6bea8/generation" dev="dm-0" ino=17388914 scontext=system_u:system_r:named_t:s0 tcontext=unconfined_u:object_r:ipa_var_lib_t:s0 tclass=file
type=AVC msg=audit(1467976092.551:666): avc:  denied  { lock } for  pid=21031 comm="named-pkcs11" path="/var/lib/ipa/dnssec/tokens/e44b3d63-08ff-e576-3086-6c51eec6bea8/generation" dev="dm-0" ino=17388914 scontext=system_u:system_r:named_t:s0 tcontext=unconfined_u:object_r:ipa_var_lib_t:s0 tclass=file
type=AVC msg=audit(1467976092.551:667): avc:  denied  { getattr } for  pid=21031 comm="named-pkcs11" path="/var/lib/ipa/dnssec/tokens/e44b3d63-08ff-e576-3086-6c51eec6bea8/generation" dev="dm-0" ino=17388914 scontext=system_u:system_r:named_t:s0 tcontext=unconfined_u:object_r:ipa_var_lib_t:s0 tclass=file

This is consistent with bug 1350957. 

# rpm -q ipa-server selinux-policy softhsm
ipa-server-4.4.0-1.el7.x86_64
selinux-policy-3.13.1-85.el7.noarch
softhsm-2.1.0-2.el7.x86_64

Right now I'm convinced that this is a dupe. If you manage to reproduce it in some other way feel free to re-open and provide additional data.

*** This bug has been marked as a duplicate of bug 1350957 ***

The original command was:

:: [  BEGIN   ] :: Running ' /usr/sbin/ipa-server-install --setup-dns --forwarder=10.16.36.29 --hostname=qe-blade-12.testrelm.test -r TESTRELM.TEST -n testrelm.test -p Secret123 -a Secret123 --ip-address=10.19.34.82 -U'

Anyway, everything seems like the dupe.

I apologize for any confusion about how I worded bug #1350957

This does look the same as that one to me.  I saw the same ipa-server-install failure.  I was just isolating the description to the easiest thing to show the AVC denials.  I mention in the description that it failed but, never showed that.  At the time I didn't think it was necessary to show the full ipa-server-install output since I was filing an selinux-policy bug.  However, it did look like this.  So, I do believe this is a dup of the AVC denial one.  If you're seeing different AVC denials, maybe those should be added to the selinux bug?