Description of problem:
Starting with development versions of certmonger leading up to 0.58, certmonger is going to gain the ability to talk directly to Dogtag servers.  The policy currently denies its attempts to do so.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-155.el6_3.noarch

How reproducible:
Always

Steps to Reproduce:
1. Install ipa-server and its dependencies.
2. Use ipa-server-install to set up the server.
3. Run "getcert start-tracking -d /etc/httpd/alias -n Signing-Cert -c dogtag-ipa-renew-agent -p /etc/httpd/alias/pwdfile.txt" to tell certmonger about the certificate.
4. Run "getcert list -c dogtag-ipa-renew-agent" to check on the certificate's lifetime.
5. Run "getcert resubmit -d /etc/httpd/alias -n Signing-Cert" to tell certmonger to attempt to renew the certificate.
6. Run "getcert list -c dogtag-ipa-renew-agent" again to check if you managed to get yourself a new certificate.
  
Actual results:
The enrollment client fails to contact the server, and the client goes back to monitoring the certificate that it already had.  It generates these AVC messages while I temporarily flip to permissive mode and try it again:

type=SYSCALL msg=audit(1340643217.213:64474): arch=c000003e syscall=42 success=no exit=-115 a0=3 a1=7fff6e012d20 a2=10 a3=7fff6e012930 items=0 ppid=6983 pid=7261 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=153 comm="dogtag-ipa-rene" exe="/usr/libexec/certmonger/dogtag-ipa-renew-agent-submit" subj=unconfined_u:system_r:certmonger_t:s0 key=(null)
type=AVC msg=audit(1340643217.213:64474): avc:  denied  { name_connect } for  pid=7261 comm="dogtag-ipa-rene" dest=9180 scontext=unconfined_u:system_r:certmonger_t:s0 tcontext=system_u:object_r:pki_ca_port_t:s0 tclass=tcp_socket

Expected results:
Success, with the second run of "getcert list" showing that the newly-issued certificate will last that much longer than the old one would have.

Additional information:
Similar changes will be needed in other releases where we include the certmonger package (Fedora, perhaps EL 5), as support for acting as a client for Dogtag will be included whenever we update the package for those releases.