openvpn bridge и selinux

Появилась нужда поднять openvpn как мост. Чтобы сразу клиента в частную сеть совать.
Сделал ключи, серты - как обычно.
Настроил сервер:

port 1194
proto tcp
dev tap0
tls-server
keepalive 10 120
persist-key
client-config-dir /etc/openvpn/cc
server-bridge 172.30.4.0 255.255.254.0 172.30.5.240 172.30.5.253
duplicate-cn
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/vpnserver.crt
key /etc/openvpn/keys/vpnserver.key
dh /etc/openvpn/keys/dh2048.pem

Сделал тап и мост:

# cat /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
HWADDR=00:AA:BB:11:22:33
TYPE=Ethernet
ONBOOT=yes
BOOTPROTO=static
BRIDGE=br1

# cat /etc/sysconfig/network-scripts/ifcfg-tap0
DEVICE=tap0
ONBOOT=yes
TYPE=Tap
BOOTPROTO=none
BRIDGE=br1

# cat /etc/sysconfig/network-scripts/ifcfg-br1
DEVICE=br1
TYPE=Bridge
ONBOOT=yes
BOOTPROTO=static
IPADDR=172.30.4.1
NETMASK=255.255.254.0

 А дальше запускаю сервер - и selinux не дает ему взлететь из-за отсутствия прав на тап:

Mar 18 22:24:09 vpn openvpn[1103]: ERROR: Cannot ioctl TUNSETIFF tap0: Permission denied (errno=13)
Mar 18 22:24:09 vpn openvpn[1103]: Exiting due to fatal error

type=SYSCALL msg=audit(1395167049.663:28): arch=c000003e syscall=16 success=no exit=-13 a0=6 a1=400454ca a2=7fffa15bc350 a3=8 items=0 ppid=1094 pid=1103 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="openvpn" exe="/usr/sbin/openvpn" subj=unconfined_u:system_r:openvpn_t:s0 key=(null)
type=AVC msg=audit(1395167130.413:29): avc:  denied  { relabelfrom } for  pid=1122 comm="openvpn" scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=tun_socket

Решил не отключать селинукс,  а сделать разрешение.

# audit2allow -w -a
type=AVC msg=audit(1395167049.663:28): avc:  denied  { relabelfrom } for  pid=1103 comm="openvpn" scontext=unconfined_u:system_r:openvpn_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=tun_socket
        Was caused by:
                Unknown - would be allowed by active policy
                Possible mismatch between this policy and the one under which the audit message was generated.

                Possible mismatch between current in-memory boolean settings vs. permanent ones.

# audit2allow -a
#============= openvpn_t ==============

#!!!! This avc is allowed in the current policy
allow openvpn_t initrc_t:tun_socket relabelfrom;


# audit2allow -a -M myopenvpn
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i myopenvpn.pp

# cat myopenvpn.te

module myopenvpn 1.0;

require {
        type openvpn_t;
        type initrc_t;
        class tun_socket relabelfrom;
}

#============= openvpn_t ==============

#!!!! This avc is allowed in the current policy
allow openvpn_t initrc_t:tun_socket relabelfrom;

# semodule -i myopenvpn.pp

Вот теперь все работает )