Description of problem:

fapolicyd won't start because of SELinux.

Version-Release number of selected component (if applicable):

fapolicyd-1.1.5-2.fc37.src.rpm

How reproducible:

Always.

Steps to Reproduce:
Update Fedora to latest release, fapolicy will break.

Actual results:

Nov 18 21:48:25 53c70r.de systemd[1]: Starting fapolicyd.service - File Access Policy Daemon...
Nov 18 21:48:25 53c70r.de fagenrules[971]: /usr/sbin/fagenrules: No change
Nov 18 21:48:25 53c70r.de systemd[1]: fapolicyd.service: Can't open PID file /run/fapolicyd.pid (yet?) after start: Operation not permitted
Nov 18 21:48:25 53c70r.de fapolicyd[1042]: Initializing the trust database
Nov 18 21:48:25 53c70r.de systemd[1]: Started fapolicyd.service - File Access Policy Daemon.
Nov 18 21:48:25 53c70r.de fapolicyd[1042]: fapolicyd integrity is 0
Nov 18 21:48:25 53c70r.de fapolicyd[1042]: Loading rpmdb backend
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Checking if the trust database up to date
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Importing trust data from rpmdb backend
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Importing trust data from file backend
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Entries in trust DB: 35966
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Loaded trust info from all backends(without duplicates): 35966
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Trust database checks OK
Nov 18 21:48:34 53c70r.de fapolicyd[1042]: Error (Permission denied) adding fanotify mark for /dev/shm
Nov 18 21:48:35 53c70r.de systemd[1]: fapolicyd.service: Main process exited, code=exited, status=1/FAILURE
Nov 18 21:48:35 53c70r.de systemd[1]: fapolicyd.service: Failed with result 'exit-code'.
Nov 18 21:48:35 53c70r.de systemd[1]: fapolicyd.service: Consumed 1.489s CPU time.

[root@53c70r ~]# audit2allow -b


#============= fapolicyd_t ==============
allow fapolicyd_t boot_t:dir watch;
allow fapolicyd_t root_t:dir watch;
allow fapolicyd_t tmp_t:dir watch;
allow fapolicyd_t tmpfs_t:dir watch;
allow fapolicyd_t user_tmp_t:dir watch;



Expected results:

No failure.
No audit log.

Additional info:

Will fix the problem:


policy_module(fapolicyd_t, 1.0.0)

gen_require(`
        type fapolicyd_t;
')

########################################
#
# fapolicyd_t customized policy
#

require {
	type fapolicyd_t;
}

#============= fapolicyd_t ==============
files_watch_boot_dirs(fapolicyd_t)
files_watch_generic_tmp_dirs(fapolicyd_t)
files_watch_root_dirs(fapolicyd_t)
fs_manage_tmpfs_dirs(fapolicyd_t)
userdom_watch_tmp_dirs(fapolicyd_t)