Bug 1996720

Description of problem:
The service rhsmcertd.service is not able to create any cache file in /var/cache/cloud-what, because rhsmcertd.service uses code from new RPM python3-cloud-what. The python3-cloud-what package does not create cache files in /var/lib/rhsm/cache as rhsmcertd, but it has its own cache directory /var/cache/cloud-what and selinux denies rhsmcertd.service to create cache files there. It cause unnecessary HTTP requests to AWS IMDS servers. 


Version-Release number of selected component (if applicable):

[root@ip-10-0-0-158 ~]# rpm -q subscription-manager
subscription-manager-1.28.20-1.git.6.504eaaf.el8.x86_64


How reproducible:
100%


Steps to Reproduce:
1. Create AWS instance and enable only IMDSv2 in the AWS wizard.

2. Start AWS instance

3. Enable automatic registration of the system using (and optionally disable splay option to not wait for result too long):
subscription-manager config --rhsmcertd.auto_registration=1
subscription-manager config --rhsmcertd.splay=0

4. Start rhsmcertd.service
[root@ip-10-0-0-158 ~]# systemctl start rhsmcertd.service

5. Wait two-three minutes for result

6. Check /var/log/rhsm/rhsm.log


Actual results:
You can observer several warning messages with following error: Permission denied: '/var/cache/cloud-what/aws_token.json'


Expected results:
rhsmcertd.service should be able to create cache file in: /var/cache/cloud-what/


Additional info:

More details here: https://bugzilla.redhat.com/show_bug.cgi?id=1922151#c11

Latest scratch build of subscription-manager: http://brew-task-repos.usersys.redhat.com/repos/scratch/jhnidek/subscription-manager/1.29.18/1.git.41.c29535a.el8/x86_64/

PR of selinux-policy for Fedora: https://github.com/fedora-selinux/selinux-policy/pull/836