Ddclient sending emails on a Postfix server

I am running ddclient on my router together with a relaying postfix 
server. Unfortunately I have configured ddclient to send emails when it 
has problems and I have had quite a few problems with AVCs as a result. 
I have figured most of them out now but there is one that I am stuck on.

It appears that sendmail (postfix variant) calls postdrop to actually 
deliver the emails, and using the 
postfix_domtrans_user_mail_handler(ddclient_t)
interface fixes most of the AVCs except two, and this is where I am 
stuck. Here is the ausearch output:

type=PROCTITLE msg=audit(1481006916.953:34919): 
proctitle=2F7573722F7362696E2F706F737464726F70002D72
type=PATH msg=audit(1481006916.953:34919): item=1 
name="/lib64/ld-linux-x86-64.so.2" inode=1478356 dev=fd:00 mode=0100755 
ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t nametype=NORMAL
type=PATH msg=audit(1481006916.953:34919): item=0 
name="/usr/sbin/postdrop" inode=818771 dev=fd:00 mode=0102711 ouid=0 
ogid=208 rdev=00:00 obj=system_u:object_r:postfix_postdrop_exec_t 
nametype=NORMAL
type=CWD msg=audit(1481006916.953:34919): cwd="/var/spool/postfix"
type=EXECVE msg=audit(1481006916.953:34919): argc=2 
a0="/usr/sbin/postdrop" a1="-r"
type=SYSCALL msg=audit(1481006916.953:34919): arch=c000003e syscall=59 
success=yes exit=0 a0=5b97747f30 a1=5b97748d70 a2=5b97747e50 a3=20 
items=2 ppid=24964 pid=24965 auid=103 uid=103 gid=246 euid=103 suid=103 
fsuid=103 egid=208 sgid=208 fsgid=208 tty=(none) ses=7 comm="postdrop" 
exe="/usr/sbin/postdrop" subj=system_u:system_r:postfix_postdrop_t 
key=(null)
type=AVC msg=audit(1481006916.953:34919): avc:  denied  { read write } 
for  pid=24965 comm="postdrop" path="socket:[2916040]" dev="sockfs" 
ino=2916040 scontext=system_u:system_r:postfix_postdrop_t 
tcontext=system_u:system_r:ddclient_t tclass=unix_stream_socket permissive=1
----
time->Tue Dec  6 06:48:36 2016
type=AVC msg=audit(1481006916.965:34920): avc:  denied  { getattr } for  
pid=24965 comm="postdrop" path="socket:[2916040]" dev="sockfs" 
ino=2916040 scontext=system_u:system_r:postfix_postdrop_t 
tcontext=system_u:system_r:ddclient_t tclass=unix_stream_socket permissive=1

The command "postdrop -r" reads a message from stdin and writes a 
response to stdout. I am guessing these socket permissions are to do 
with piping stdout back to sendmail (running in ddclient_t), but I would 
have expected a fifo_file on a pipe rather than a socket? I can always 
check this with the postfix forum if needed.

I guess the "wrong" solution would be to require postfix_postdrop_t and 
allow it to access ddclient_t etc, but that would violate the rules, so 
either the postdrop interface is wrong or perhaps I should be doing this 
without a domain transition. That is how I started out and I had a whole 
lot more AVCs that are fixed by the transition, so I am tending towards 
the postdrop interface being not quite right?

Any views would be very much appreciated.

Best wishes,

Robert Sharp