type=AVC msg=audit(1322872499.463:79140): avc:  denied  { read } for  pid=29716 comm="ipa_kpasswd" name="urandom" dev=devtmpfs ino=1048 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1322872499.463:79140): arch=c000003e syscall=2 success=no exit=-13 a0=7ffc7e83bd06 a1=0 a2=0 a3=7fffd942e0e0 items=0 ppid=29474 pid=29716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ipa_kpasswd" exe="/usr/sbin/ipa_kpasswd" subj=system_u:system_r:ipa_kpasswd_t:s0 key=(null)
type=AVC msg=audit(1322872499.493:79141): avc:  denied  { read } for  pid=29716 comm="ipa_kpasswd" name="urandom" dev=devtmpfs ino=1048 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1322872499.493:79141): arch=c000003e syscall=2 success=no exit=-13 a0=7ffc7e83bd06 a1=0 a2=0 a3=7fffd942ba50 items=0 ppid=29474 pid=29716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ipa_kpasswd" exe="/usr/sbin/ipa_kpasswd" subj=system_u:system_r:ipa_kpasswd_t:s0 key=(null)
type=AVC msg=audit(1322872499.669:79142): avc:  denied  { name_connect } for  pid=29716 comm="ipa_kpasswd" dest=389 scontext=system_u:system_r:ipa_kpasswd_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1322872499.669:79142): arch=c000003e syscall=42 success=no exit=-13 a0=9 a1=170f960 a2=10 a3=7fffd942d760 items=0 ppid=29474 pid=29716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ipa_kpasswd" exe="/usr/sbin/ipa_kpasswd" subj=system_u:system_r:ipa_kpasswd_t:s0 key=(null)
type=ANOM_ABEND msg=audit(1322872499.670:79143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:ipa_kpasswd_t:s0 pid=29716 comm="ipa_kpasswd" sig=11

#============= ipa_kpasswd_t ==============
#!!!! This avc can be allowed using one of the these booleans:
#     authlogin_nsswitch_use_ldap, allow_ypbind

allow ipa_kpasswd_t ldap_port_t:tcp_socket name_connect;
#!!!! This avc can be allowed using one of the these booleans:
#     authlogin_nsswitch_use_ldap, global_ssp

allow ipa_kpasswd_t urandom_device_t:chr_file read;