Description of problem:
Customer is facing some AVC when he runs hostnamectl and timedatectl from a process created through pacemaker, thus with an inherited cluster_t context:

~~~
type=USER_AVC msg=audit(04/26/23 08:27:01.918:2156) : pid=993 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.189 spid=18983 tpid=18982 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'

type=USER_AVC msg=audit(04/26/23 08:27:26.940:2167) : pid=993 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.191 spid=19456 tpid=19454 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:system_r:cluster_t:s0 tclass=dbus  exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
~~~

Version-Release number of selected component (if applicable):
RHEL 7
selinux-policy-targeted-3.13.1-268.el7.noarch

How reproducible:
Always

Steps to Reproduce:
1. run a hostnamectl or timedatectl in cluster_t context
2. 
3. 

Actual results:
 the dbus message is sent but the answer is blocked

Expected results:
 dbus message received and no timeout

Additional info:

Similar issues seen for other calling app and contexts, but same purpose: https://bugzilla.redhat.com/show_bug.cgi?id=2154245
https://bugzilla.redhat.com/show_bug.cgi?id=1667016
https://bugzilla.redhat.com/show_bug.cgi?id=1656814
Current workaround from this KCS:  https://access.redhat.com/solutions/3814531


Created the SELinux custom module as shown below. 

1)	Installed the SELinux-policy-devel package on our build server. 

2)	Write the custom module in the name of onlineaudit.te. 

# cd /usr/share/selinux/devel/

# cat onlineaudit.te

module onlineaudit 1.0;

require {
    attribute domain;
    class dbus send_msg;
    type cluster_t;               This selinux type we picked from the audit log error.
}

# Allow all domains to send back dbus response
allow domain cluster_t : dbus send_msg;

3)	Compiled the custom module using the below command. 

# make onlineaudit.pp

4)	Finally transferred the onlineaudit.pp module file to the target OCC server and loaded the custom module into the policy using the below command. 

# semodule -i onlineaudit.pp

5)	Verified the custom module is loaded into the policy or not. Post that script works fine through java.

# semanage module -l | grep onlineaudit
onlineaudit               400       pp