NM spawns dnsmasq for a variety of reasons, and one is in a local caching nameserver configuration.  For that purpose, NM has to write out a custom configuration file, and NM writes that file to /var/run.  dnsmasq can't read it when SELinux is enforcing however.

allow dnsmasq_t NetworkManager_var_run_t:file { read getattr };

is the denial line.