Description of problem:
--------------------
[root@f16-pki ~]# cat /var/log/audit/audit.log | audit2allow -R

require {
	type ephemeral_port_t;
	type pki_ca_t;
	class tcp_socket name_connect;
}

#============= pki_ca_t ==============
allow pki_ca_t ephemeral_port_t:tcp_socket name_connect;
corenet_tcp_bind_generic_port(pki_ca_t)
files_manage_urandom_seed(pki_ca_t)
--------------------

Version-Release number of selected component (if applicable):
--------------------
[root@f16-pki ~]# rpm -q pki-selinux pki-ca
pki-selinux-9.0.17-1.fc16.noarch
pki-ca-9.0.17-1.fc16.noarch
[root@f16-pki ~]# 
--------------------

How reproducible:
All the time 

Steps to Reproduce:
1/ Run the below to create a CA instance:
###########################
pkicreate -pki_instance_root=/var/lib        \
          -pki_instance_name=pki-ca          \
          -subsystem_type=ca                 \
          -agent_secure_port=9443            \
          -ee_secure_port=9444               \
          -ee_secure_client_auth_port=9446   \
          -admin_secure_port=9445            \
          -unsecure_port=9180                \
          -tomcat_server_port=9701           \
          -user=pkiuser                      \
          -group=pkiuser                     \
          -redirect conf=/etc/pki-ca         \
          -redirect logs=/var/log/pki-ca     \
          -verbose
###########################
  
Actual results:
###########################
[debug] run_command(/bin/systemctl restart pki-cad)
[error] FAILED run_command("/bin/systemctl restart pki-cad"), exit status=1 output="Job failed. See system logs and 'systemctl status' for details."
Before proceeding with the configuration, make sure 
the firewall settings of this machine permit proper 
access to this subsystem. 
###########################


Expected results:
CA instance restart should happen successfully.

Workaround: Putting SELinux in permissive lets the CA instance restart successfully