I've filed a bug to get the policy fixed.  As for the lack of error messages, I'm wondering if that is a systemd-python issue.  Poking around.

I can confirm this problem. Is there any recommended workaround until the fix for #1133248 is released?

Just the usual method of using audit2allow to create a custom policy module.

Here are the missing policies (at least for fail2ban on RHEL 7):



module myfail2ban 1.0;

require {
        type fail2ban_client_exec_t;
        type logrotate_t;
        class file { read execute open execute_no_trans };
}

#============= logrotate_t ==============
allow logrotate_t fail2ban_client_exec_t:file { read execute open execute_no_trans };

require {
        type syslogd_var_run_t;
        type fail2ban_t;
        class dir read;
}

#============= fail2ban_t ==============
allow fail2ban_t syslogd_var_run_t:dir read;

require {
        type syslogd_var_run_t;
        type fail2ban_t;
        class file { read open getattr };
}

#============= fail2ban_t ==============
allow fail2ban_t syslogd_var_run_t:file { read open getattr };



You can copy / paste the above into myfail2ban.te, then run:

$ sudo checkmodule -M -m -o myfail2ban.mod myfail2ban.te
$ sudo semodule_package -o myfail2ban.pp -m myfail2ban.mod
$ sudo semodule -i myfail2ban.pp

The reason for the "my" prefix is to not collide with the fail2ban policy provided by selinux-policy-targeted.  Once upstream fixes the policy you can delete your "my" module.

I think this is fixed by the selinux-policy changes.