Description of problem:
This occurs right after starting systemd-resolved.service.
SELinux is preventing systemd-resolve from 'map' accesses on the file /usr/share/p11-kit/modules/p11-kit-trust.module.

*****  Plugin catchall_boolean (57.6 confidence) suggests   ******************

If you want to allow domain to can mmap files
Then you must tell SELinux about this by enabling the 'domain_can_mmap_files' boolean.

Do
setsebool -P domain_can_mmap_files 1

*****  Plugin catchall_labels (36.2 confidence) suggests   *******************

If you want to allow systemd-resolve to have map access on the p11-kit-trust.module file
Then you need to change the label on /usr/share/p11-kit/modules/p11-kit-trust.module
Do
# semanage fcontext -a -t FILE_TYPE '/usr/share/p11-kit/modules/p11-kit-trust.module'
where FILE_TYPE is one of the following: abrt_helper_exec_t, file_context_t, fonts_cache_t, fonts_t, ld_so_cache_t, ld_so_t, lib_t, locale_t, nscd_var_run_t, passwd_file_t, pkcs11_modules_conf_t, prelink_exec_t, sssd_public_t, systemd_resolved_exec_t, textrel_shlib_t.
Then execute:
restorecon -v '/usr/share/p11-kit/modules/p11-kit-trust.module'


*****  Plugin catchall (7.64 confidence) suggests   **************************

If you believe that systemd-resolve should be allowed map access on the p11-kit-trust.module file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-resolve' --raw | audit2allow -M my-systemdresolve
# semodule -X 300 -i my-systemdresolve.pp

Additional Information:
Source Context                system_u:system_r:systemd_resolved_t:s0
Target Context                system_u:object_r:usr_t:s0
Target Objects                /usr/share/p11-kit/modules/p11-kit-trust.module [
                              file ]
Source                        systemd-resolve
Source Path                   systemd-resolve
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           p11-kit-trust-0.23.16.1-2.fc31.x86_64
Policy RPM                    selinux-policy-3.14.4-40.fc31.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.3.11-300.fc31.x86_64 #1 SMP Tue
                              Nov 12 19:08:07 UTC 2019 x86_64 x86_64
Alert Count                   25
First Seen                    2019-10-18 16:01:24 CEST
Last Seen                     2019-11-19 09:06:44 CET
Local ID                      b5ea236c-3547-452a-ac17-652a039cec85

Raw Audit Messages
type=AVC msg=audit(1574150804.923:127): avc:  denied  { map } for  pid=850 comm="systemd-resolve" path="/usr/share/p11-kit/modules/p11-kit-trust.module" dev="sda3" ino=43436304 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=0


Hash: systemd-resolve,systemd_resolved_t,usr_t,file,map

Version-Release number of selected component:
selinux-policy-3.14.4-40.fc31.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.11.3
hashmarkername: setroubleshoot
kernel:         5.3.11-300.fc31.x86_64
type:           libreport