Description of problem:
SELinux does not yet have a policy for OpenDMARC so it generates AVCs

Version-Release number of selected component (if applicable):
OpenDMARC 1.1.3 (based on https://bugzilla.redhat.com/show_bug.cgi?id=905304)

$ rpm -qa | grep selinux
selinux-policy-3.7.19-195.el6_4.12.noarch
libselinux-2.0.94-5.3.el6_4.1.x86_64
libselinux-python-2.0.94-5.3.el6_4.1.x86_64
selinux-policy-targeted-3.7.19-195.el6_4.12.noarch
libselinux-utils-2.0.94-5.3.el6_4.1.x86_64

How reproducible:
Install OpenDMARC 1.1.3, configure it, configure milter in Postfix, start OpenDMARC, reload Postfix, send test message to Postfix server, see AVCs being generated

Steps to Reproduce:
1. install and configure OpenDMARC, Postfix
2. send test email to Postfix server
3. see AVCs being generated

Actual results:
OpenDMARC is blocked and interaction between Postfix and OpenDMARC is blocked. 

Expected results:
No blockage, everything working, more spam defeated.

Additional info:

OpenDMARC is another new anti-spam with the Internet's 800 pound gorilla's already using it (Google, Facebook, etc.). Currently it is not yet available in any Fedora or EPEL repo (review in progress in bz905304). Lacking an SELinux policy will prevent OpenDMARC from working properly. To prevent this I am submitting this report in the hopes that when OpenDMARC shows up in Fedora & EPEL it will work out of the box right away.

OpenDMARC works pretty much the same as OpenDKIM so perhaps that policy can be used as a basis to save some time.

The OpenDMARC default config uses the following files, directories and commands:

Config file /etc/opendmarc.conf
BaseDirectory /var/run/opendmarc
HistoryFile /var/spool/opendmarc/opendmarc.dat
IgnoreHosts /etc/opendmarc/ignore.hosts
PidFile /var/run/opendmarc.pid
ReportCommand /usr/sbin/sendmail -t
Socket /var/run/opendmarc/opendmarc.sock
Socket inet:8893@localhost
SyslogFacility mail (must be able to log to /var/log/maillog)
TemporaryDirectory /var/tmp
UserID  opendmarc:mail


The AVCs I found thus far (using socket /var/run/opendmarc/opendmarc.sock):

type=AVC msg=audit(1373546882.708:293036): avc:  denied  { write } for  pid=18947 comm="smtpd" name="opendmarc.sock" dev=vda2 ino=5376619 scontext=unconfined_u:system_r:postfix_smtpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file

type=AVC msg=audit(1373546882.708:293036): avc:  denied  { connectto } for  pid=18947 comm="smtpd" path="/var/run/opendmarc/opendmarc.sock" scontext=unconfined_u:system_r:postfix_smtpd_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket

type=AVC msg=audit(1373546883.814:293038): avc:  denied  { connectto } for  pid=18977 comm="cleanup" path="/var/run/opendmarc/opendmarc.sock" scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket

type=AVC msg=audit(1373546873.676:293034): avc:  denied  { read } for  pid=18971 comm="sendmail" path="inotify" dev=inotifyfs ino=1 scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=system_u:object_r:inotifyfs_t:s0 tclass=dir

If you need more information please let me know. Thanks!