Description of problem:
Openvpn cannot be configured to write log files.

Version-Release number of selected component (if applicable):
selinux-policy-3.12.1-74.4
openvpn-2.3.2-4

How reproducible:
Always

Steps to Reproduce:
1. Configure /etc/openvpn/server.conf to include the following entry:
--- edit begin
log /var/log/openvpn/openvpn.log
--- edit end
(note: /var/log/openvpn.log also fails)

2. Start the openvpn server

3. Check syslog and find the following error:
openvpn[####]: Warning: Error redirecting stdout/stderr to --log file: /var/log/openvpn/openvpn.log: Permission denied (errno=13)

Actual results:
Selinux prevented file write, audit2why shows:

type=AVC msg=audit(###): avc:  denied  { write } for  pid=#### comm="openvpn" name="openvpn.log" dev="dm-2" ino=1575681 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:openvpn_var_log_t:s0 tclass=file

Expected results:
Log file may be written.

Additional info:

Relevant file_context is:

/var/log/openvpn.*      system_u:object_r:openvpn_var_log_t:s0                  

So any files prefixed with /var/log/openvpn should be an allowable log file context.

Adding the following to the policy

#============= openvpn_t ==============
allow openvpn_t openvpn_var_log_t:file write;

allows the log file to be written as expected, so no other permissions are in error.