Created attachment 1176928 [details]
avc.txt

With selinux enabled, and designate with the bind9 backend installed through puppet-designate, the following AVCs are fired when named is reloaded with configuration that includes files from /var/lib/designate.
In /etc/named.conf, we add the line:
include /var/lib/designate/bind9/zones.config;

AVCs and reproducer script in attachment (assumes to be running on an ephemeral centos7-minimal installation, it will install on localhost).

[root@n48 ~]# ls -alZ /var/lib/designate/
drwxr-xr-x. designate designate system_u:object_r:var_lib_t:s0   .
drwxr-xr-x. root      root      system_u:object_r:var_lib_t:s0   ..
drwxrwx---. named     named     system_u:object_r:var_lib_t:s0   bind9
[root@n48 ~]# restorecon -Rv /var/lib/designate/
[root@n48 ~]# ls -alZ /var/lib/designate/
drwxr-xr-x. designate designate system_u:object_r:var_lib_t:s0   .
drwxr-xr-x. root      root      system_u:object_r:var_lib_t:s0   ..
drwxrwx---. named     named     system_u:object_r:var_lib_t:s0   bind9