SELinux denies execute of script resulting in a complex looking custom policy

Question

The heartbeat type polling tool nanny (part of Piranha / Linux Virtual Server / LVS / IPVS) is being denied access to my "sendprogram" scripts by SELinux. Setting the context alone is not sufficient. There are four different scripts mainly using curl.

What is the best way to allow a context to execute scripts that could require a broad range of permissions?

---

Originally unconfined_u:system_r:piranha_lvs_t:s0 was denied execute. I used audit2allow and after a couple of attempts the policy looks rather large and I get the feeling I am doing it wrong...

grep nanny /var/log/audit/audit.log | audit2allow -m piranha_nannymonitorscripts > piranha_nannymonitorscripts.te
tail -n20 /var/log/audit/audit.log | audit2allow -m piranha_nannymonitorscripts > piranha_nannymonitorscripts.te

Eventually resulted in

    module piranha_nannymonitorscripts 1.0;

require {
        type tmp_t;
        type cert_t;
        type usr_t;
        type urandom_device_t;
        type sysctl_net_t;
        type piranha_lvs_t;
        class process sigkill;
        class chr_file read;
        class capability dac_override;
        class file write;
        class lnk_file read;
        class dir { read write search };
}

#============= piranha_lvs_t ==============
allow piranha_lvs_t cert_t:file write;
allow piranha_lvs_t self:capability dac_override;
allow piranha_lvs_t self:process sigkill;
allow piranha_lvs_t sysctl_net_t:dir search;
#!!!! The source type 'piranha_lvs_t' can write to a 'dir' of the following types:
# var_run_t, piranha_lvs_var_run_t, root_t

allow piranha_lvs_t tmp_t:dir { read write };
#!!!! This avc can be allowed using the boolean 'global_ssp'

allow piranha_lvs_t urandom_device_t:chr_file read;
allow piranha_lvs_t usr_t:lnk_file read;