This is a question of selinux policy. Reassigning.

Well, it looks like this relates with 

os.system("createrepo /tmp/path")

which I believe could be dontaudited.

Also I would start to think about a new domain for your script.

Miroslav and Karel, 
  I think this bz should be moved back to the createrepo component


I was under the impression that this bug was an issue with createrepo and not the SELinux policy.

My understanding is:
  createrepo runs some initialization code accessing /var/lib/rpm/Packages 
  for the use case described here this initialization code is probably not needed, the SELinux policy does the right thing and stops createrepo running under httpd_t from accessing /var/lib/rpm/Packages.

 I think the fix is to modify createrepo so it does not try to access /var/lib/rpm/Packages, maybe provide a CLI option to skip this or some other means.

 Intent is to avoid needing the dontaudit.   
 For short term, we are including a dontaudit in our SELinux Policy.  This bugzilla is to address the long term work on createrepo.

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

 I'm not sure what you expect createrepo to do here. The access is probably from:

    ts = rpmUtils.transaction.initReadOnlyTransaction()

...which uses /var/lib/rpm by default, in theory we could create a tmp. dir. and do:

    ts = rpmUtils.transaction.initReadOnlyTransaction(root=myemptyrpmroot)

...but it feels like working around the problem, in that what you really need to say is some policy like "when running createrepo from httpd_t we need to change to createrepo_t" or something.

Well did the repo actually get created?  IE If we can dontaudit access to rpm  from apache, and the tool works we are ok.  Although not sure sure what leak happens allowing httpd to read rpm data.

In answering Daniel Walsh's question: "Well did the repo actually get created?"

Yes, the functionality of createrepo was not impaired.