Description of problem:
Following upgrade of Cacti, the web interface says "System log file is not available for writing, please enable write access
Log: /usr/share/cacti/log/cacti.log"
This is an SELinux denial - doing "setenforce 0" allows it to work.


Version-Release number of selected component (if applicable):
Old version: cacti-1.1.38-4.fc29.noarch
New version: cacti-1.2.0-2.fc29.noarch

How reproducible:
The error appears every time with SELinux enabled.

Steps to Reproduce:
1. Upgrade Cacti via DNF
2. Hit Cacti web UI


Actual results:
"System log file is not available for writing, please enable write access
Log: /usr/share/cacti/log/cacti.log"

Journal contains:
Jan 19 15:03:38 hostname.example.comaudit[20144]: AVC avc:  denied  { write } for  pid=20144 comm="php-fpm" name="cacti.log" dev="dm-1" ino=397807 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_log_t:s0 tclass=file permissive=0
Jan 19 15:03:38 hostname.example.comkernel: audit: type=1400 audit(1547910218.579:462396): avc:  denied  { write } for  pid=20144 comm="php-fpm" name="cacti.log" dev="dm-1" ino=397807 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_log_t:s0 tclass=file permissive=0
Jan 19 15:03:38 hostname.example.comkernel: audit: type=1300 audit(1547910218.579:462396): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fff5141a140 a2=2 a3=0 items=0 ppid=20141 pid=20144 auid=4294967295 uid=48 gid=480 euid=48 suid=48 fsuid=48 egid=480 sgid=480 fsgid=480 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
Jan 19 15:03:38 hostname.example.comaudit[20144]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fff5141a140 a2=2 a3=0 items=0 ppid=20141 pid=20144 auid=4294967295 uid=48 gid=480 euid=48 suid=48 fsuid=48 egid=480 sgid=480 fsgid=480 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)


Expected results:
No error, Cacti loads OK.

Additional info:
I note also that /usr/share/cacti/log is a symlink to /var/log/cacti.

I have created a local SELinux policy from the above log lines - this allows Cacti to work again.