Description of problem:
Squid fails to start. Service status shows:

Oct 05 10:43:42 workstation.marston squid[9300]: Ipc::Mem::Segment::attach failed to mmap(/squid-cf__metadata.shm): (13) Permission denied

audit.log contains:

type=AVC msg=audit(1507196622.502:322): avc:  denied  { map } for  pid=9300 comm="squid" path="/dev/shm/squid-cf__metadata.shm" dev="tmpfs" ino=111601 scontext=system_u:system_r:squid_t:s0 tcontext=system_u:object_r:squid_tmpfs_t:s0 tclass=file permissive=0


Version-Release number of selected component (if applicable):
squid-4.0.21-1.fc27.x86_64
selinux-policy-targeted-3.13.1-283.4.fc27.noarch

How reproducible:
100% on my system, freshly upgraded to F27 from F26, where squid was working fine.


Steps to Reproduce:

squid.conf is almost stock. Only significant different is this stanza:

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/spool/squid 100 16 256
cache_replacement_policy heap LFUDA
cache_dir aufs /var/spool/squid 16000 16 256 max-size=8589934592
maximum_object_size 8192 MB

Additional information:

The following policy, auto-generated by audit2allow, allows squid to start:

policy_module(squid-local, 1.0)

require {
	type squid_t;
	type squid_tmpfs_t;
	class file map;
}

#============= squid_t ==============
allow squid_t squid_tmpfs_t:file map;