Description of problem:
After updating the selinux-policy package to version 3.13.1-166.el7.noarch, tomcat service does not start any longer due to an AVC denial:

avc:  denied  { setsched } for  pid=... comm="java" scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:system_r:tomcat_t:s0 tclass=process

Version-Release number of selected component (if applicable):
tomcat-7.0.76-2.el7.noarch
java-1.8.0-ibm-1.8.0.4.10-1jpp.3.el7.x86_64
selinux-policy-3.13.1-166.el7_4.4.noarch

How reproducible:
Always

Steps to Reproduce:
1. Update the selinux-package
2. Start tomcat service

Actual results:
service did not start, traces with classpath values

Expected results:
service started

Additional info:
Downgrading selinux-policy to version 3.13.1-102.el7_3.16 has been confirmed as a workaround.

The tomcat_t domain used to be an unconfined domain in RHEL 7.3. In RHEL 7.4, only some permissions are allowed for the process class:

  # sesearch -A -s tomcat_t -t tomcat_t -c process
Found 1 semantic av rules:
   allow tomcat_t tomcat_t : process { fork sigchld sigkill sigstop signull signal getsched getcap execmem } ;