Description of problem:

Insight generates AVC for command "systemctl status --all" when system has persistent journal.

The AVC produced show that `insights_client_t` is trying to access the context `var_log_t` when "systemctl status --all" command is run for `{ map }` access and fail.
----
type=PROCTITLE msg=audit(06/13/2023 08:21:20.521:3138) : proctitle=/bin/systemctl status --all 
type=MMAP msg=audit(06/13/2023 08:21:20.521:3138) : fd=5 flags=MAP_SHARED 
type=SYSCALL msg=audit(06/13/2023 08:21:20.521:3138) : arch=x86_64 syscall=mmap success=yes exit=140486428573696 a0=0x0 a1=0x800000 a2=PROT_READ a3=MAP_SHARED items=0 ppid=97396 pid=97397 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/usr/bin/systemctl subj=system_u:system_r:insights_client_t:s0 key=(null) 
type=AVC msg=audit(06/13/2023 08:21:20.521:3138) : avc:  denied  { map } for  pid=97397 comm=systemctl path=/var/log/journal/system dev="dm-0" ino=151680 scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1 
----

As per the insights-client.log it looks like it tries to reach to the API gives a JSON response on what the command information is needed.
~~~
2023-06-13 08:22:37,680    DEBUG insights.client.collection_rules Attemping to download collection rules from https://cert-api.access.redhat.com/r/insights/v1/static/uploader.v2.json
2023-06-13 08:22:37,680  NETWORK insights.client.connection GET https://cert-api.access.redhat.com/r/insights/v1/static/uploader.v2.json
2023-06-13 08:22:37,703  NETWORK insights.client.connection HTTP Status: 200 OK

<...output skipped...>

        {
            "command": "/bin/systemctl status --all",
            "pattern": [
                "Failed: ",
                "Jobs: ",
                "State: "
            ],
            "symbolic_name": "systemctl_status_all"
        },

<...output skipped...>

~~~


This is happening because the system journal is persistent and logging to /var/log/journal/ which has the context of var_log_t.

I confirmed in the latest SELinux rules this permission is not allowed.
~~~
# sesearch -A -s insights_client_t -t var_log_t -c file -p map
allow domain file_type:file map; [ domain_can_mmap_files ]:True

# sesearch -A -s insights_client_t -t var_log_t -c file 
allow daemon logfile:file { append getattr ioctl lock };
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow insights_client_t file_type:file getattr;
allow insights_client_t non_security_file_type:file { getattr ioctl lock open read };
~~~


This does not happen for non-persistent journal. 
We see that when the destination file context is "syslogd_var_run_t" i.e. file presents in (/run/log/journal/<..something..>.journal) it does not show this error and has the `{ map }` present.
~~~
# sesearch -A -s insights_client_t -t syslogd_var_run_t -c file -p map
allow domain file_type:file map; [ domain_can_mmap_files ]:True
allow insights_client_t syslogd_var_run_t:file map;
~~~





Version-Release number of selected component (if applicable):
insights-client-3.1.7-12.el8.noarch
selinux-policy-3.14.3-117.el8.noarch
selinux-policy-targeted-3.14.3-117.el8.noarch


How reproducible:
Everytime

Steps to Reproduce:
1. Ensure that you have a persistent journal following along the Step from - https://access.redhat.com/solutions/696893

  # sed -i 's/#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf
  # systemctl restart systemd-journald.service
  # journalctl --flush


2. Start insights-client service and wait for it to complete.
 
  # systemctl start  insights-client
  # systemctl status insights-client

3. Checked the audit logs to see the AVC

  # ausearch -m AVC,USER_AVC -i -ts recent


Actual results:
Insight service provide AVC when systemctl status is run

Expected results:
Insights service should complete without AVC.

Additional info: