Description of problem:

Jun  8 04:02:15 xxx kernel: audit(1149732135.028:4): avc:  denied  { append }
for  pid=2639 comm="prelink" name="prelink.log" dev=hda1 ino=458825
scontext=user_u:system_r:prelink_t:s0 tcontext=user_u:object_r:var_log_t:s0
tclass=file
Jun  8 04:02:15 xxx kernel: audit(1149732135.028:5): avc:  denied  { append }
for  pid=2639 comm="prelink" name="prelink.log" dev=hda1 ino=458825
scontext=user_u:system_r:prelink_t:s0 tcontext=user_u:object_r:var_log_t:s0
tclass=file

Version-Release number of selected component (if applicable):

clean/fresh/minimal/yesterday install with all updates

How reproducible:

leave system for night ;)

Actual results:

# getfattr -d -h -m. /var/log/prelink.log
getfattr: Removing leading '/' from absolute path names
# file: var/log/prelink.log
security.selinux="user_u:object_r:var_log_t:s0\000"

Expected results:

# getfattr -d -h -m. /var/log/prelink.log
getfattr: Removing leading '/' from absolute path names
# file: var/log/prelink.log
security.selinux="system_u:object_r:prelink_log_t:s0\000"

Additional info:

I don't know why this file have wrong context.
`restorecon /var/log/prelink.log` helps but real problem is cause of this.