Description of problem:
Currently SElinux policy forbids kadmind from communicating with slapd via ldapi.

Version-Release number of selected component (if applicable):
libselinux-2.0.94-2.el6.x86_64
libselinux-utils-2.0.94-2.el6.x86_64
selinux-policy-3.7.19-54.el6_0.5.noarch
libselinux-ruby-2.0.94-2.el6.x86_64
selinux-policy-targeted-3.7.19-54.el6_0.5.noarch
krb5-server-1.8.2-3.el6_0.7.x86_64
krb5-server-ldap-1.8.2-3.el6_0.7.x86_64
krb5-workstation-1.8.2-3.el6_0.7.x86_64
krb5-libs-1.8.2-3.el6_0.7.x86_64
openldap-2.4.19-15.el6_0.2.x86_64
openldap-servers-2.4.19-15.el6_0.2.x86_64
openldap-clients-2.4.19-15.el6_0.2.x86_64


How reproducible:
Everytime

Steps to Reproduce:
1.Configure  krb5.conf such that kadmin it is communicating to a backend openldap database on same host
2. Try to start kadmin service 
3. 

Actual results:
Starting Kerberos 5 Admin Server: kadmind: Can't contact LDAP server while initializing, aborting

Expected results:
kadmin service starts

Additional info:
setenforce 0 does allow kadmin to start. Basically we need to allow kadmind to communicate with slapd via a socket (/var/run/ldapi)

Generating an selinux module with:

grep kadmin audit.log | audit2allow -M kadminldapilocal

produces the following kadminldapilocal.te

module kadminldapilocal 1.0;

require {
        type slapd_t;
        type slapd_var_run_t;
        type kadmind_t;
        class sock_file write;
        class unix_stream_socket connectto;
}

#============= kadmind_t ==============
allow kadmind_t slapd_t:unix_stream_socket connectto;
allow kadmind_t slapd_var_run_t:sock_file write;