kl2tpd denials when running under NetworkManager-l2tp

[tomparkin]

When using kl2tpd in conjunction with NetworkManager-l2tp to set up a VPN connection, kl2tpd is denied access to sysfs and netlink_generic_socket (sealert messages attached).

I was able to address this locally by installing this module:

vagrant@lac:~$ cat kl2tpd.te 

module kl2tpd 1.0;

require {
	type l2tpd_t;
	type sysfs_t;
	class file { open read };
	class netlink_generic_socket { bind create getattr getopt };
}

#============= l2tpd_t ==============
allow l2tpd_t self:netlink_generic_socket { bind create getattr getopt };
allow l2tpd_t sysfs_t:file { open read };

I think the correct approach would be to add something equivalent to this into the l2tp.te in selinux-policy, but I wanted to check whether this was the best approach prior to attempting to make the change.

sealert.txt

[zpytela]

If there is justification, the best approach is to submit a PR with a brief explanation, reproducer, configuration change, denial, anything. At a first glance the policy looks reasonable.