Description of problem:
SELinux policy targeted as provided on Fedora 27 prevents dnsmasq from sending messages over dbus to (as far as I understand) acknowledge changes in the nameserver list.  When connecting to a VPN, dnsmasq will not update the nameserver list and will keep using the old nameservers.

Typical AVC under Permissive mode:
type=USER_AVC msg=audit(1515355945.646:1293): pid=939 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.333 spid=9390 tpid=16945 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'


Version-Release number of selected component (if applicable):
Fedora 27
selinux-policy-targeted-3.13.1-283.17.fc27.noarch
dnsmasq-2.78-1.fc27.x86_64
NetworkManager-1.8.4-7.fc27.x86_64
NetworkManager-openvpn-1.8.0-3.fc27.x86_64
openvpn-2.4.4-1.fc27.x86_64
NetworkManager-openvpn-gnome-1.8.0-3.fc27.x86_64

How reproducible:
Every time.


Steps to Reproduce:
1. Set NetworkManager to use dnsmasq as DNS manager (dns=dnsmasq in NetworkManager.conf) and restart NetworkManager
2. Connect to a VPN on OpenVPN
3. Try to resolve a hostname on the VPN without manually setting your nameservers to include the VPN's.


Actual results:
Internal VPN hostname will fail to resolve -- VPN's nameserver won't be queried at all.


Expected results:
Internal VPN hostname should be resolved by the VPN nameserver.


Additional info:
Confirmed failure to even get a version number from dnsmasq through dbus using gdbus CLI utility:
$ sudo setenforce 1
$ sudo gdbus call -y -d org.freedesktop.NetworkManager.dnsmasq -o  /uk/org/thekelleys/dnsmasq -m uk.org.thekelleys.dnsmasq.GetVersion
   (FAILURE MESSAGE)

$ sudo setenforce 0
$ sudo gdbus call -y -d org.freedesktop.NetworkManager.dnsmasq -o  /uk/org/thekelleys/dnsmasq -m uk.org.thekelleys.dnsmasq.GetVersion
('2.78',)


In addition, "audit2allow -M dnsmasq-selinux-dbus" produced a TE module with this content:
~~~
module dnsmasq-selinux-dbus 1.0;

require {
        type dnsmasq_t;
        type unconfined_t;
        class dbus send_msg;
}

#============= dnsmasq_t ==============
allow dnsmasq_t unconfined_t:dbus send_msg;
~~~

Curiously enough, NetworkManager is *not* running with unconfined_t but NetworkManager_t as expected.

I loaded the new module and the problem is now fixed.