Bug 1823672

Description of problem:

When rsyslog is configured to write logs to a file in a non-standard place (e.g. /my/custom/log directory labeled "public_content_rw_t"), AVCs related to browsing the parent directories are seen *and* rsyslog is not functional:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow syslogd_t public_content_rw_t:dir search;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

In the logs we can see a lot of Permission denies:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
error during config processing: omfile: creating parent directories for file  '/my/custom/log/file' failed: Permission denied [v8.37.0-13.el8 try http://www.rsyslog.com/e/2207 ]
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

See also BZ #1821725 on RHEL 7.


Version-Release number of selected component (if applicable):

rsyslog-8.37.0-13.el8.x86_64 & selinux-policy-3.14.3-20.el8.noarch


How reproducible:

ALWAYS

Steps to Reproduce:
1. Create a custom directory containing log files

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# mkdir -p /my/custom/log
# semanage fcontext -a -t public_content_rw_t "/my/custom(/.*)?"
# restorecon -Frv /my
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. Configure rsyslog to write logs to this location

/etc/rsyslog.conf:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
*.info;mail.none;authpriv.none;cron.none                /my/custom/log/file
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. Restart rsyslog

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# systemctl restart rsyslog

# ausearch -m avc -ts recent
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Actual results:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
#============= syslogd_t ==============
allow syslogd_t public_content_rw_t:dir search;
allow syslogd_t public_content_rw_t:file { append getattr ioctl open };
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Expected results:

Only AVC related to appending to the log file since rsyslog cannot append to public_content_rw_t file by default:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow syslogd_t public_content_rw_t:file { append getattr ioctl open };
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Additional info:

The example above was taken from a real customer case where the customer wants to export logs through http/ftp.
Of course, appending to the log file would require a dedicated rule, which is not covered here.

The failure happens due to rsyslog not being able to browse the parent directories up to the log file.
In most use cases, it is not sufficient to only add a rule for "public_content_rw_t:dir" but for any non security file type instead:

non_security_file_type:dir