Description of problem:
Confined users cannot query systemd journal when logged on console

Version-Release number of selected component (if applicable):
selinux-policy-3.14.5-11.fc32.noarch

How reproducible:
always

Steps to Reproduce:
1. A confined user user_u, staff_u, or sysadm_t logs in on a console
2. run journalctl

Actual results:
$ journalctl -l --user
<no output in enforcing mode>
AVC's audited in permissive:
----
type=PROCTITLE msg=audit(11/01/19 09:11:06.778:2636) : proctitle=journalctl -l --user 
type=PATH msg=audit(11/01/19 09:11:06.778:2636) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=273424 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(11/01/19 09:11:06.778:2636) : item=0 name=/usr/bin/journalctl inode=275732 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:journalctl_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(11/01/19 09:11:06.778:2636) : cwd=/home/sysadm 
type=EXECVE msg=audit(11/01/19 09:11:06.778:2636) : argc=3 a0=journalctl a1=-l a2=--user 
type=SYSCALL msg=audit(11/01/19 09:11:06.778:2636) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x55e0e5d55070 a1=0x55e0e5d515f0 a2=0x55e0e5d59850 a3=0x8 items=2 ppid=35872 pid=35913 auid=sysadm uid=sysadm gid=sysadm euid=sysadm suid=sysadm fsuid=sysadm egid=sysadm sgid=sysadm fsgid=sysadm tty=tty5 ses=210 comm=journalctl exe=/usr/bin/journalctl subj=sysadm_u:sysadm_r:journalctl_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(11/01/19 09:11:06.778:2636) : avc:  denied  { read write } for  pid=35913 comm=journalctl path=/dev/tty5 dev="devtmpfs" ino=1047 scontext=sysadm_u:sysadm_r:journalctl_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:user_tty_device_t:s0 tclass=chr_file permissive=1 
----
type=PROCTITLE msg=audit(11/01/19 09:11:06.812:2637) : proctitle=journalctl -l --user 
type=SYSCALL msg=audit(11/01/19 09:11:06.812:2637) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x1 a1=TCGETS a2=0x7fffe232dc30 a3=0x0 items=0 ppid=35872 pid=35913 auid=sysadm uid=sysadm gid=sysadm euid=sysadm suid=sysadm fsuid=sysadm egid=sysadm sgid=sysadm fsgid=sysadm tty=tty5 ses=210 comm=journalctl exe=/usr/bin/journalctl subj=sysadm_u:sysadm_r:journalctl_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(11/01/19 09:11:06.812:2637) : avc:  denied  { ioctl } for  pid=35913 comm=journalctl path=/dev/tty5 dev="devtmpfs" ino=1047 ioctlcmd=TCGETS scontext=sysadm_u:sysadm_r:journalctl_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:user_tty_device_t:s0 tclass=chr_file permissive=1 
Fri Nov  1 09:11:16 CET 2019

Expected results:
list of journal entries

Additional info:
These permissions are allowed:
allow journalctl_t user_devpts_t:chr_file { append getattr ioctl lock read write };