Description of problem:
It seems that secadm_r doesn't have write permission to both default_context_t and selinux_config_t. I expected it would have write permission at least to selinux_config_t.

[root/secadm_r/SystemLow@ntc242 ~]# sesearch --role_source secadm_r -s secadm_t -t selinux_config_t --allow
Found 11 semantic av rules:
   allow secadm_usertype selinux_config_t : file { ioctl read getattr lock open } ;
   allow secadm_usertype selinux_config_t : dir { ioctl read getattr lock search open } ;
   allow secadm_usertype selinux_config_t : lnk_file { read getattr } ;
   allow secadm_t selinux_config_t : file { getattr relabelfrom relabelto } ;
   allow secadm_t selinux_config_t : dir { ioctl read getattr lock relabelfrom relabelto search open } ;
   allow secadm_t selinux_config_t : lnk_file { getattr relabelfrom relabelto } ;
   allow secadm_t selinux_config_t : chr_file { getattr relabelfrom relabelto } ;
   allow secadm_t selinux_config_t : blk_file { getattr relabelfrom relabelto } ;
   allow secadm_t selinux_config_t : sock_file { getattr relabelfrom relabelto } ;
   allow secadm_t selinux_config_t : fifo_file { getattr relabelfrom relabelto } ;
   allow secadm_usertype file_type : filesystem getattr ;

[root/secadm_r/SystemLow@ntc242 ~]#

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: