Description of problem:
This is not a selinux-policy issue, however selinux-policy can sweep it under the rug.

Version-Release number of selected component (if applicable):
fail2ban-0.8.4-29.el5

How reproducible:
always

Steps to Reproduce:
# service fail2ban restart
# ausearch -m avc -m user_avc -m selinux_err -i -ts recent

Actual results:
----
type=SYSCALL msg=audit(07/31/2013 08:32:06.726:419) : arch=x86_64 syscall=execve success=yes exit=0 a0=1a368580 a1=1a368cc0 a2=1a367400 a3=8 items=0 ppid=13320 pid=13321 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=20 comm=iptables exe=/sbin/iptables subj=root:system_r:iptables_t:s0 key=(null) 
type=AVC msg=audit(07/31/2013 08:32:06.726:419) : avc:  denied  { read write } for  pid=13321 comm=iptables path=socket:[180185] dev=sockfs ino=180185 scontext=root:system_r:iptables_t:s0 tcontext=root:system_r:initrc_t:s0 tclass=unix_stream_socket 
type=AVC msg=audit(07/31/2013 08:32:06.726:419) : avc:  denied  { read write } for  pid=13321 comm=iptables path=socket:[180180] dev=sockfs ino=180180 scontext=root:system_r:iptables_t:s0 tcontext=root:system_r:initrc_t:s0 tclass=unix_dgram_socket 
type=AVC msg=audit(07/31/2013 08:32:06.726:419) : avc:  denied  { read write } for  pid=13321 comm=iptables path=socket:[180377] dev=sockfs ino=180377 scontext=root:system_r:iptables_t:s0 tcontext=root:system_r:initrc_t:s0 tclass=unix_stream_socket 
----

Expected results:
 * file descriptors are not leaked