I believe that in order for a process to open a port < 1024, they require
net_bind_service.  So if you want openvpn to work on this port, you need to
write some quick local policy

audit2allow -M myopenvpn < /var/log/audit/audit.log

If you change to use a port > 1024 this change will not be necessary.

Ok, thanks a lot.
Now I think 'net_bind_service' is somehow decieving, 'net_bind_privileged' would
be a better name for it, at least to me, but it's definitely a minor issue.

Blame the kernel guys,  We use their names.  I am just a simple userspace hacker.

:^)

Eh, I knew that Daniel, no worries. B-)
BTW, I've learned something new on audit2allow (-M option, very useful!)


Here's the complete solution to run openvpn on port 999(udp). Nothing new here,
I'm adding this for reference only:

The following command is needed for any port (but 1194 of course):

# semanage port -a -p udp -t openvpn_port_t 999

The following commands are also needed only if port is privileged, that is < 1024

# yum install selinux-policy-devel

# mkdir selinux_local

# cd selinux_local

# vi local.te

# cat local.te
module local 1.0;

require {
        class capability net_bind_service;
        type openvpn_t;
};

allow openvpn_t self:capability net_bind_service;

# make -f /usr/share/selinux/devel/Makefile
Compiling targeted local module
/usr/bin/checkmodule:  loading policy configuration from tmp/local.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 6) to tmp/local.mod
Creating targeted local.pp policy package
rm tmp/local.mod.fc tmp/local.mod

# ls
local.fc  local.if  local.pp  local.te  tmp

# semodule -i local.pp

I tend to keep all local policy modifications (if small) in a single local
module. The reference policy makes it very easy.