Description of problem:

I would like to provision a tap device at boot.  I have configured /etc/sysconfig/network-scripts/ifcfg-tap0 like this:

DEVICE="tap0"
TYPE=Tap
BRIDGE=br0
NM_CONTROLLED="no"
BOOTPROTO="none"
ONBOOT="yes"
OWNER=openvpn

With selinux in enforcing mode this does not come at boot, and the following AVC is logged:

type=AVC msg=audit(1376408921.417:1199): avc:  denied  { relabelfrom } for  pid=1912 comm="ip" scontext=system_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=tun_socket
type=AVC msg=audit(1376408963.758:9): avc:  denied  { create } for  pid=368 comm="ip" scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=tun_socket
type=AVC msg=audit(1376409394.827:7): avc:  denied  { create } for  pid=367 comm="ip" scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=tun_socket
type=AVC msg=audit(1376409530.983:605): avc:  denied  { relabelfrom } for  pid=1421 comm="ip" scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=tun_socket
type=AVC msg=audit(1376409530.983:605): avc:  denied  { relabelto } for  pid=1421 comm="ip" scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ifconfig_t:s0 tclass=tun_socket


Version-Release number of selected component (if applicable):

Fedora 19, selinux-policy-targeted-3.12.1-69.fc19.noarch

I've corrected this locally by loading in the following selinux policy module, generated with audit2allow:

module tuntap 1.0;

require {
	type ifconfig_t;
	type unconfined_t;
	class tun_socket { relabelfrom relabelto create };
}

#============= ifconfig_t ==============
allow ifconfig_t self:tun_socket { relabelfrom relabelto create };
allow ifconfig_t unconfined_t:tun_socket relabelfrom;

But it seems as if this should work out of the box.