Description of problem:
rpcbind.socket will not start because of AVCs.

Breaks all NFS mounts


Version-Release number of selected component (if applicable):
selinux-policy.noarch            3.13.1-224.fc25
selinux-policy-targeted.noarch   3.13.1-224.fc25


How reproducible:
always

Steps to Reproduce:
1. systemctl enable rpcbind.socket
2. reboot
3.

Actual results:
AVCs, see below

Expected results:
no AVCs

Additional info:

====================

SELinux is preventing systemd from listen access on the unix_stream_socket /run/rpcbind.sock.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd should be allowed listen access on the rpcbind.sock unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                /run/rpcbind.sock [ unix_stream_socket ]
Source                        systemd
Source Path                   systemd
Port                          <Unknown>
Host                          paul.internal.Hupie.com
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-224.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     paul.internal.Hupie.com
Platform                      Linux paul.internal.Hupie.com
                              4.8.11-300.fc25.x86_64 #1 SMP Mon Nov 28 18:24:51
                              UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-12-07 10:02:07 CET
Last Seen                     2016-12-07 10:02:07 CET
Local ID                      a4bc101e-db12-4fc0-bfdd-3c5fa5a3b4bd

Raw Audit Messages
type=AVC msg=audit(1481101327.576:281): avc:  denied  { listen } for  pid=1 comm="systemd" path="/run/rpcbind.sock" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1


Hash: systemd,init_t,unconfined_service_t,unix_stream_socket,listen


==================

ausearch -c 'systemd' --raw | audit2allow -M my-systemd

module my-systemd 1.0;

require {
	type unconfined_service_t;
	type init_t;
	class tcp_socket { bind create listen setopt };
	class udp_socket { bind create setopt };
	class unix_stream_socket { bind create listen setopt };
}

#============= init_t ==============
allow init_t unconfined_service_t:tcp_socket { bind create listen setopt };
allow init_t unconfined_service_t:udp_socket { bind create setopt };
allow init_t unconfined_service_t:unix_stream_socket { bind create listen setopt };

==