I just upgraded to 6.4 and I am seeing a lot of audit messages:

$ sudo ls -lah /var/log/audit
total 25M
drwxr-x---.  2 root root 4.0K Feb 21 23:16 .
drwxr-xr-x. 18 root root 4.0K Feb 21 22:55 ..
-rw-------.  1 root root 549K Feb 21 23:16 audit.log
-r--------.  1 root root 6.1M Feb 21 23:16 audit.log.1
-r--------.  1 root root 6.1M Feb 21 23:16 audit.log.2
-r--------.  1 root root 6.1M Feb 21 23:15 audit.log.3
-r--------.  1 root root 6.1M Feb 21 23:14 audit.log.4

They all look similar:

type=AVC msg=audit(1361485377.617:6769463): avc:  denied  { read } for  pid=2405 comm="cgrulesengd" path="inotify" dev=inotifyfs ino=1 scontext=system_u:system_r:cgred_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1361485377.617:6769463): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7fffef90a3f0 a2=400 a3=0 items=0 ppid=1 pid=2405 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cgrulesengd" exe="/sbin/cgrulesengd" subj=system_u:system_r:cgred_t:s0 key=(null)

I added a fix to RHEL6.5. I guess we need to get it to RHEL6.4, rght?

BTW. As a quick workaround you can feed the log messages to audit2allow -R -M cgrulesengd. This will generate a cgrulesengd.pp that can be added with semodule -i cgrulesengd.pp. The cgrulesengd.te file will show the policy generated:

policy_module(cgrulesengd, 1.0)

require {
	type cgred_t;
}

#============= cgred_t ==============
fs_list_inotifyfs(cgred_t)

I know that cgrulesengd can use inotifyfs,

# strings `which cgrulesengd` | grep inotify
Error intializing inotify subsystem
inotify_init
inotify_add_watch
#

but I'm unable to persuade cgrulesengd to actually use it, therefore no AVCs appeared on my machine. Could you help me?

(In reply to comment #3)
> I added a fix to RHEL6.5. I guess we need to get it to RHEL6.4, rght?

Yes, we would like this bug Z-Streamed for RHEL 6.4.

I don't see any AVCs when the policy module (comment#4) is loaded.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1598.html