1160796 - SELinux change allowing celery to make TCP connections to all hosts and ports

[bmbouter]

https://bugzilla.redhat.com/show_bug.cgi?id=1160796

This PR removes some portions of the SELinux policy that granted specific ports, and replaces it with a policy that grants all TCP port access to all nodes. It also adds some notes to the policy about why. These changes were also discussed on #selinux on freenode.

The BZ is about a problem accessing the proxy port, but after discussion it was determined that restricting Pulp's network access prevents normal pulp operation since sync or SMTP can be done on any port. Rather than adding another whitelist for the default proxy port, we're opening up all TCP connections. This is also OK because admins can use network or host firewalls to guard against unwanted network traffic.

I compiled this on EL6, EL7, FC19, and FC20 to ensure it will compile without error.

I also smoke tested repo create/sync/delete and consumer register/bind/update/unbind/unregister on EL6 with SELinux in enforcing mode and everything worked for me.

[mhrivnak]

My expertise isn't strong enough to verify that this is correct, but it does look reasonable. It conceptually matches my expectations, and I have confidence that you implemented it correctly. :)

LGTM