Description of problem:
rolekit (actually roled) forks and exec()s 'yum install' to ensure that all of the packages it needs for a role deployment are in place.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-90.fc21.noarch

How reproducible:
Every time

Steps to Reproduce:
1. Install a completely pristine Fedora Server 21 Beta system with all defaults.
2. run 'rolectl deploy --settings-file=/root/settings.json domaincontroller' with an appropriate settings.json (see https://fedorahosted.org/rolekit/wiki/DomainController)

Actual results:
The deployment fails during package installation, throwing script errors in the logs.

Expected results:
The deployment should succeed.

Additional info:

found 1 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

SELinux is preventing yum from using the transition access on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that yum should be allowed transition access on processes labeled rpm_script_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep yum /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:rolekit_t:s0
Target Context                system_u:system_r:rpm_script_t:s0
Target Objects                /usr/bin/bash [ process ]
Source                        yum
Source Path                   yum
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           bash-4.3.30-2.fc21.x86_64
Policy RPM                    selinux-policy-3.13.1-90.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     freeipa.rc1.beta.validation
Platform                      Linux freeipa.rc1.beta.validation
                              3.17.1-302.fc21.x86_64 #1 SMP Fri Oct 17 20:05:46
                              UTC 2014 x86_64 x86_64
Alert Count                   70
First Seen                    2014-10-24 06:29:11 EDT
Last Seen                     2014-10-24 06:30:51 EDT
Local ID                      74efb75d-0eeb-4ac6-917f-3319c5955648

Raw Audit Messages
type=AVC msg=audit(1414146651.343:464): avc:  denied  { transition } for  pid=1213 comm="yum" path="/usr/bin/bash" dev="dm-0" ino=267821 scontext=system_u:system_r:rolekit_t:s0 tcontext=system_u:system_r:rpm_script_t:s0 tclass=process permissive=0


Hash: yum,rolekit_t,rpm_script_t,process,transition