rc-service syslog-ng restart
Authenticating root.
* Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ...
* /var/lib/syslog-ng: creating directory
* checkpath: unable to open directory: Permission denied
* ERROR: syslog-ng failed to start

# AVC: denied { read } for pid=1234 comm="checkpath" name="syslog-ng" dev="sda4" ino=12345 scontext=system_u:object_r:tmpfiles_t tcontext=system_u:object_r:syslogd_var_lib_d tclass=dir permissive=0

sesearch -s tmpfiles_t -t syslogd_var_lib_t -A
allow tmpfiles_t file_type:filesystem getattr;