This research spike comes out of discussion with Julie Pichon and our SELinux experts (Dan Walsh specifically).

Specific details are in the linked RHBZ but in brief: We need to research the feasibility and plan for the removal of the selinux dac_override. Dan Walsh has created a blog article[1] describing why this may have been put in place and how to work around it.

[1] https://danwalsh.livejournal.com/79643.html