Description of problem:

SELinux on Satellite 5.4 prevents Monitoring from ssh'ing to client system. /var/log/audit/audit.log shows read access to /etc/pki/tls/openssl.cnf is denied:

type=AVC msg=audit(1304370588.980:2349): avc:  denied  { read } for  pid=12555 comm="ssh" name="openssl.cnf" dev=dm-0 ino=46792934 scontext=root:system_r:spacewalk_monitoring_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file

The default context is:

# ls -lZ /etc/pki/tls/openssl.cnf 
-rw-r--r--  root root system_u:object_r:cert_t         /etc/pki/tls/openssl.cnf


Version-Release number of selected component (if applicable):
spacewalk-monitoring-1.1.1-1.el5sat
spacewalk-monitoring-selinux-1.1.1-1.el5sat

How reproducible:
100%

Steps to Reproduce:
1. Configure Monitoring probe Satellite 5.4 with SELinux in Permissive mode.
2. Enable Enforcing mode:

# setenforce 1

3. Verify that probe updates start failing, with the following Status String on the system's Monitoring tab:

The RHN Monitoring Daemon (RHNMD) is not responding: Auto configuration failed 12555:error:0200100D:system library:fopen:Permission denied:bss_file.c:122:fopen('/etc/pki/tls/openssl.cnf','rb') 12555:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:127: 12555:error:0E078002:configuration file routines:DEF_LOAD:system lib:conf_def.c:199:. Please make sure the daemon is running and the host is accessible from the monitoring scout. Command was: /usr/bin/ssh -l nocpulse -p 4545 -i /var/lib/nocpulse/.ssh/nocpulse-identity -o StrictHostKeyChecking=no -o BatchMode=yes XX.XX.XX.XX /bin/sh -s 

Actual results:

SELinux denials and monitoring probe failure, with the above errors.

Expected results:

No SELinux denials or monitoring probe failures when SELinux is Enforcing.

Additional info: