Description of problem:

When trying to execute dracut as a service, we can see ldconfig fails due to not being able to read/write files from dracut's temporary directory used as its chroot.
This happens while "ldconfig -r /var/tmp/dracut..." is executed:

/usr/sbin/dracut:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
1543     if ! ldconfig -r "$initdir"; then
1544         if [[ $UID = 0 ]]; then
1545             derror "ldconfig exited ungracefully"
1546         else
1547             derror "ldconfig might need uid=0 (root) for chroot()"
1548         fi
1549     fi
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

It appears that the policy is missing many rules to allow this (and IMHO this should be allowed, it's perfectly legit to rebuild automatically the initramfs based on some custom trigger):

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
module my-ldconfig 1.0;

require {
	type hostname_t;
	type initrc_tmp_t;
	type ldconfig_t;
	class fifo_file write;
	class lnk_file { getattr unlink create };
	class file { create rename setattr unlink };
	class dir { add_name remove_name read write };
}

#============= hostname_t ==============
allow hostname_t initrc_tmp_t:fifo_file write;

#============= ldconfig_t ==============
allow ldconfig_t initrc_tmp_t:dir { add_name remove_name read write };
allow ldconfig_t initrc_tmp_t:file { create rename setattr unlink };
allow ldconfig_t initrc_tmp_t:fifo_file write;
allow ldconfig_t initrc_tmp_t:lnk_file { getattr unlink create };
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Note that the "hostname_t" rule is needed for giving back the hostname to ldconfig.


Version-Release number of selected component (if applicable):

All, up to latest RHEL7 selinux-policy-3.13.1-252.el7.1.noarch


How reproducible:

Always


Steps to Reproduce:
1. Create a service calling dracut

# cat > /etc/systemd/system/dracut.service << EOF
[Service]
Type=oneshot
ExecStart=/bin/bash -c "dracut -f /boot/initramfs-$(uname -r).img $(uname -r)"
EOF

# systemctl daemon-reload

2. Execute the service

# systemctl start dracut


Actual results:

AVCs


Expected results:

No AVC