Latest EL7 selinux policy version generates a lot of AVCs related to self:capability net_admin, and when attempting to run "audit2allow" on the output, an error is thrown to stderr about "unrecognized class capability". E.g.:

type=AVC msg=audit(1482418180.175:84305): avc:  denied  { net_admin } for  pid=25662 comm="showq" capability=12  scontext=system_u:system_r:postfix_showq_t:s0 tcontext=system_u:system_r:postfix_showq_t:s0 tclass=capability
type=SYSCALL msg=audit(1482418180.175:84305): arch=c000003e syscall=47 success=yes exit=3420 a0=8 a1=7fffff749930 a2=0 a3=0 items=0 ppid=2597 pid=25662 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="showq" exe="/usr/libexec/postfix/showq" subj=system_u:system_r:postfix_showq_t:s0 key=(null)

Attempting to run audit2allow on the same system for this AVC returns:

libsepol.sepol_string_to_security_class: unrecognized class capability

#============= postfix_showq_t ==============
allow postfix_showq_t self:capability net_admin;

Moreover, this inserts a weird "1d" hex character after "capability":

00000070  3d 3d 3d 3d 3d 3d 3d 3d  3d 3d 3d 3d 3d 3d 0a 61  |==============.a|
00000080  6c 6c 6f 77 20 70 6f 73  74 66 69 78 5f 73 68 6f  |llow postfix_sho|
00000090  77 71 5f 74 20 73 65 6c  66 3a 63 61 70 61 62 69  |wq_t self:capabi|
000000a0  6c 69 74 79 1d 20 6e 65  74 5f 61 64 6d 69 6e 3b  |lity. net_admin;|
000000b0  0a                                                |.|

which, in our particular case, makes it difficult to mail the results, as that non-ascii character confuses mailx (but it's probably a side-effect of the error message above).