Using a transport in my exim.conf to use the Dovecot LDA:
# Taken from http://wiki.dovecot.org/LDA/Exim
dovecot_delivery:
  driver = pipe
  command = /usr/libexec/dovecot/deliver 
  message_prefix =
  message_suffix =
  log_output
  delivery_date_add
  envelope_to_add
  return_path_add
  #group = mail
  #mode = 0660
  temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78

However, no idea why it's trying to write to my fail2ban.log!



Summary:

SELinux is preventing /usr/libexec/dovecot/deliver access to a leaked
/var/log/fail2ban.log file descriptor.

Detailed Description:

[deliver has a permissive type (dovecot_deliver_t). This access was not denied.]

SELinux denied access requested by the deliver command. It looks like this is
either a leaked descriptor or deliver output was redirected to a file it is not
allowed to access. Leaks usually can be ignored since SELinux is just closing
the leak and reporting the error. The application does not use the descriptor,
so it will run properly. If this is a redirection, you will not get output in
the /var/log/fail2ban.log. You should generate a bugzilla on selinux-policy, and
it will get routed to the appropriate package. You can safely ignore this avc.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385)

Additional Information:

Source Context                unconfined_u:system_r:dovecot_deliver_t:s0
Target Context                unconfined_u:object_r:fail2ban_log_t:s0
Target Objects                /var/log/fail2ban.log [ file ]
Source                        deliver
Source Path                   /usr/libexec/dovecot/deliver
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           dovecot-1.2.14-1.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-57.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   leaks
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.34.6-54.fc13.x86_64 #1 SMP Sun Sep 5 17:16:27
                              UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Thu 23 Sep 2010 11:56:38 BST
Last Seen                     Thu 23 Sep 2010 11:56:38 BST
Local ID                      71324d7c-4591-4f5f-aa42-01c5a69d0b19
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1285239398.131:2580): avc:  denied  { append } for  pid=3009 comm="deliver" path="/var/log/fail2ban.log" dev=dm-1 ino=393953 scontext=unconfined_u:system_r:dovecot_deliver_t:s0 tcontext=unconfined_u:object_r:fail2ban_log_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1285239398.131:2580): arch=c000003e syscall=59 success=yes exit=0 a0=7fcdf2f040b0 a1=7fcdf2f03ec0 a2=7fff85f1b5d0 a3=7fff85f1b240 items=0 ppid=3008 pid=3009 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=2 comm="deliver" exe="/usr/libexec/dovecot/deliver" subj=unconfined_u:system_r:dovecot_deliver_t:s0 key=(null)



Hash String generated from  leaks,deliver,dovecot_deliver_t,fail2ban_log_t,file,append
audit2allow suggests:

#============= dovecot_deliver_t ==============
allow dovecot_deliver_t fail2ban_log_t:file append;