Bug 2097681

Description of problem:
SELinux prevents a systemd service from starting if it uses LoadCredentials=. The service fails with status 243

Version-Release number of selected component (if applicable):
Version      : 36.10
Release      : 1.fc36

How reproducible:
Easy

Steps to Reproduce:
Using the example command from the systemd documentation (https://systemd.io/CREDENTIALS/). 
1. systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc

Actual results:
Running as unit: run-u71.service
Finished with result: exit-code
Main processes terminated with: code=exited/status=243
Service runtime: 12ms
CPU time consumed: 12ms

Expected results:
After executing 'setenforce 0', the service is allowed to start.
Running as unit: run-u75.service
# Loopback entries; do not change.
# For historical reasons, localhost precedes localhost.localdomain:
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
# See hosts(5) for proper format and other examples:
# 192.168.1.10 foo.mydomain.org foo
# 192.168.1.13 bar.mydomain.org bar
Finished with result: success
Main processes terminated with: code=exited/status=0
Service runtime: 33ms
CPU time consumed: 26ms

Additional info:

`ausearch -c creds` shows

time->Thu Jun 16 11:45:19 2022
type=AVC msg=audit(1655372719.715:508): avc:  denied  { read write open } for  pid=2049 comm="(sd-mkdcreds)" path="/dev/shm/.#cred22355fda375e1b92" dev="ramfs" ino=31825 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1
----
time->Thu Jun 16 11:45:19 2022
type=AVC msg=audit(1655372719.715:509): avc:  denied  { setattr } for  pid=2049 comm="(sd-mkdcreds)" name=".#cred22355fda375e1b92" dev="ramfs" ino=31825 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1
----
time->Thu Jun 16 11:45:19 2022
type=AVC msg=audit(1655372719.715:510): avc:  denied  { rename } for  pid=2049 comm="(sd-mkdcreds)" name=".#cred22355fda375e1b92" dev="ramfs" ino=31825 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ramfs_t:s0 tclass=file permissive=1

The policy is missing rules to allow this.