Description of problem:

If you try to install dogtag on top of the latest selinux policy -- selinux-policy-3.10.0-137.fc17 , the installation fails.  This used to work just fine for 
selinux-policy-3.10.0-132.fc17

I suspect that this has to do with changes made to the way tomcat starts (as dogtag CA is a tomcat instance).

This breaks dogtag which breaks IPA.

Specfically, audit2allow indicates that the following are required:

[root@vm-063 ~]# audit2allow -R -i /var/log/audit/audit.log 
WARNING: Policy would be downgraded from version 27 to 26.
require {
	type tomcat_exec_t;
	type pki_ca_t;
	class file { ioctl getattr read open execute execute_no_trans };
}

#============= pki_ca_t ==============
allow pki_ca_t tomcat_exec_t:file { ioctl execute read open getattr execute_no_trans };
miscfiles_read_hwdata(pki_ca_t)
tomcat_search_cache(pki_ca_t)

[root@vm-063 ~]# audit2allow  -i /var/log/audit/audit.log 
WARNING: Policy would be downgraded from version 27 to 26.
#============= pki_ca_t ==============
allow pki_ca_t hwdata_t:dir search;
allow pki_ca_t hwdata_t:file { read getattr open };
allow pki_ca_t tomcat_cache_t:dir getattr;
allow pki_ca_t tomcat_exec_t:file { ioctl execute read open getattr execute_no_trans };

[root@vm-063 ~]# grep avc /var/log/audit/audit.log 
type=AVC msg=audit(1342803940.898:638): avc:  denied  { read } for  pid=27521 comm="lspci" name="pci.ids" dev="dm-0" ino=7309 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file
type=AVC msg=audit(1342803940.898:638): avc:  denied  { open } for  pid=27521 comm="lspci" name="pci.ids" dev="dm-0" ino=7309 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file
type=AVC msg=audit(1342803940.898:639): avc:  denied  { getattr } for  pid=27521 comm="lspci" path="/usr/share/hwdata/pci.ids" dev="dm-0" ino=7309 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file
type=AVC msg=audit(1342803940.933:640): avc:  denied  { execute } for  pid=27529 comm="sh" name="tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342803940.933:640): avc:  denied  { read open } for  pid=27529 comm="sh" name="tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342803940.933:640): avc:  denied  { execute_no_trans } for  pid=27529 comm="sh" path="/usr/sbin/tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342803940.937:641): avc:  denied  { ioctl } for  pid=27529 comm="tomcat6" path="/usr/sbin/tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342803940.937:642): avc:  denied  { getattr } for  pid=27529 comm="tomcat6" path="/usr/sbin/tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342803941.408:646): avc:  denied  { getattr } for  pid=27552 comm="java" path="/var/cache/tomcat6/temp" dev="dm-0" ino=142220 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_cache_t:s0 tclass=dir
type=AVC msg=audit(1342804745.165:736): avc:  denied  { search } for  pid=29023 comm="lspci" name="hwdata" dev="dm-0" ino=7306 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=dir
type=AVC msg=audit(1342804745.165:737): avc:  denied  { search } for  pid=29023 comm="lspci" name="hwdata" dev="dm-0" ino=7306 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=dir
type=AVC msg=audit(1342804745.186:738): avc:  denied  { execute } for  pid=29031 comm="sh" name="tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342804745.187:739): avc:  denied  { getattr } for  pid=29031 comm="sh" path="/usr/sbin/tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file
type=AVC msg=audit(1342804745.187:740): avc:  denied  { getattr } for  pid=29031 comm="sh" path="/usr/sbin/tomcat6" dev="dm-0" ino=22747 scontext=system_u:system_r:pki_ca_t:s0 tcontext=system_u:object_r:tomcat_exec_t:s0 tclass=file


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: