Description of problem:

Seems like perhaps SELinux 'policies' could come to the rescue (if devel there would contribute) because best would be - I think - if there were booleans for that.

More denials against log files, ningx, apache.

...
SELinux is preventing /usr/bin/python3.9 from watch access on the file /var/log/httpd/error_log
...
Should be easy to reproduce, with pretty vanilla-default fail2ban setup.

-> $ cat my-fail2banserver.te

module my-fail2banserver 1.0;

require {
	type fail2ban_t;
	type httpd_log_t;
	class dir watch;
	class file watch;
}

#============= fail2ban_t ==============
allow fail2ban_t httpd_log_t:dir watch;
allow fail2ban_t httpd_log_t:file watch;

many thanks, L.

Version-Release number of selected component (if applicable):

fail2ban-firewalld-0.11.2-11.el9.noarch
fail2ban-server-0.11.2-11.el9.noarch
selinux-policy-34.1.27-1.el9.noarch

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: