Description of problem:

- When rsyslog is configured to read logs from a file ("imfile" module) and the file's parent directories are non-standard (e.g. /var/www/prod/host/logs/access_log), AVCs related to browsing the parent directories are seen but rsyslog is still functional:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow syslogd_t httpd_sys_content_t:dir read;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This is new with latest rsyslog-8.24.0-52.el7.x86_64 

- When rsyslog is configured to write logs to a file in a non-standard place (e.g. /my/custom/log directory labeled "public_content_rw_t"), AVCs related to browsing the parent directories are seen *and* rsyslog is not functional:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow syslogd_t public_content_rw_t:dir search;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

In the logs we can see a lot of Permission denies:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
omfile: creating parent directories for file  'Permission denied' failed: /my/custom/log/messages [v8.24.0-52.el7]
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

rsyslog-8.24.0-52.el7.x86_64 & selinux-policy-3.13.1-266.el7.noarch


How reproducible:

Always


Steps to Reproduce:
1. Configure "omfile" to write to some alternate directory

in /etc/rsyslog.conf:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
*.info;mail.none;authpriv.none;cron.none;local2.none                /my/custom/log/messages
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

custom contexts:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# semanage fcontext -a -t public_content_rw_t "/my/custom(/.*)?"
# semanage fcontext -a -t var_log_t "/my/custom/log(/.*)?"
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. Configure "imfile" to read from some alternate directory (regular path under /var/www):

in /etc/rsyslog.d/web.conf:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ModLoad imfile
$InputFileName /var/www/prod/host/logs/access_log
$InputFileTag www_tag
$InputFileSeverity notice
$InputFileFacility local6
$InputFilePersistStateInterval 0
$InputRunFileMonitor
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

create the dirs:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# mkdir -p /var/www/prod/host/logs
# restorecon -Frv /var/www/prod
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. Restart rsyslog

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# systemctl restart rsyslog
# ausearch -m avc -ts recent | grep -w syslogd_t | audit2allow
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Actual results:

#============= syslogd_t ==============
allow syslogd_t httpd_sys_content_t:dir read;
allow syslogd_t public_content_rw_t:dir search;

Expected results:

No AVCs

Additional info:

In the example above, "omfile" logs were to be placed in a directory under public_content_rw_t (but logs still labeled var_log_t).
This comes from a real case from customer.

The wish fix is to allow syslogd_t to read/search any directory except secure content, it shouldn't be limited to httpd/public_content stuff.