+++ This bug was initially created as a clone of Bug #1483550 +++

Description of problem:

I'm getting a SELinux denial when my test script runs:

echo 0 > /proc/irq/em1/smp_affinity_list

or using tuna:

tuna --irqs=31 --cpus=0 --move


The audit.log shows:

time->Fri Aug 18 17:42:37 2017
type=PROCTITLE msg=audit(1503092557.985:76): proctitle=2F62696E2F7368002D63006563686F20223022203E2F70726F632F6972712F35382F736D705F616666696E6974795F6C697374
type=SYSCALL msg=audit(1503092557.985:76): arch=c000003e syscall=2 success=yes exit=3 a0=ec9d40 a1=241 a2=1b6 a3=0 items=0 ppid=14390 pid=22048 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:unconfined_service_t:s0 key=(null)
type=AVC msg=audit(1503092557.985:76): avc:  denied  { associate } for  pid=22048 comm="sh" name="smp_affinity_list" scontext=system_u:object_r:sysctl_irq_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0


Version-Release number of selected component (if applicable):

[root@localhost ~]# rpm -qa selinux-policy
selinux-policy-3.13.1-166.el7.noarch
[root@localhost ~]# rpm -qa selinux-policy-targeted
selinux-policy-targeted-3.13.1-166.el7.noarch


How reproducible:
Everytime I write to smp_affinity_list

Steps to Reproduce:
1. write to smp_affinity_list
2.
3.

Actual results:
AVC denial

Expected results:
no denial


--- Additional comment from Milos Malik on 2017-08-21 07:57:50 EDT ---

Following SELinux denial appeared in enforcing mode:
----
type=PROCTITLE msg=audit(08/21/2017 07:55:50.160:286) : proctitle=/usr/bin/python /usr/bin/tuna --irqs=28 --cpus=0 --move 
type=SYSCALL msg=audit(08/21/2017 07:55:50.160:286) : arch=x86_64 syscall=open success=yes exit=3 a0=0x1441770 a1=O_WRONLY|O_CREAT|O_TRUNC a2=0666 a3=0x24 items=0 ppid=9447 pid=9491 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=2 comm=tuna exe=/usr/bin/python2.7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(08/21/2017 07:55:50.160:286) : avc:  denied  { associate } for  pid=9491 comm=tuna name=smp_affinity scontext=unconfined_u:object_r:sysctl_irq_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0 
----

The same command executed in permissive mode triggered following SELinux denial:
----
type=PROCTITLE msg=audit(08/21/2017 07:56:54.840:288) : proctitle=/usr/bin/python /usr/bin/tuna --irqs=28 --cpus=0 --move 
type=SYSCALL msg=audit(08/21/2017 07:56:54.840:288) : arch=x86_64 syscall=open success=yes exit=3 a0=0x2346770 a1=O_WRONLY|O_CREAT|O_TRUNC a2=0666 a3=0x24 items=0 ppid=9447 pid=9495 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=2 comm=tuna exe=/usr/bin/python2.7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(08/21/2017 07:56:54.840:288) : avc:  denied  { associate } for  pid=9495 comm=tuna name=smp_affinity scontext=unconfined_u:object_r:sysctl_irq_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=1 
----