Description of problem:

I have httpd_read_user_content turned on. Every time httpd tries to read a file in one of the user directories, there's an SELinux denial for map access.

Here's an example:

SELinux is preventing httpd from map access on the file /home/site/dmnes-site/static/images/twitter.svg.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that httpd should be allowed map access on the twitter.svg file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -X 300 -i my-httpd.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:user_home_t:s0
Target Objects                /home/site/dmnes-site/static/images/twitter.svg [
                              file ]
Source                        httpd
Source Path                   httpd
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-283.26.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     nym
Platform                      Linux nym 4.15.6-300.fc27.x86_64 #1 SMP Mon Feb 26
                              18:43:03 UTC 2018 x86_64 x86_64
Alert Count                   16
First Seen                    2018-03-11 01:49:39 UTC
Last Seen                     2018-03-14 07:04:02 UTC
Local ID                      9a551419-0ec1-47ab-9f7b-b3a35876735f

Raw Audit Messages
type=AVC msg=audit(1521011042.352:1932): avc:  denied  { map } for  pid=900 comm="httpd" path="/home/site/dmnes-site/static/images/twitter.svg" dev="sda2" ino=4468189 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file permissive=0


Hash: httpd,httpd_t,user_home_t,file,map


Version-Release number of selected component (if applicable):


How reproducible:

Always.

Steps to Reproduce:
1. Turn on httpd_read_user_content. 
2. Browse to the user web space.
3.

Actual results:

SELinux denial

Expected results:

No denial

Additional info:

This is new in Fedora 27. I didn't see these denials on any of my systems when running Fedora 26, but now have it on all of them which serve out user content.