I've only encountered BZ#1811407 and this is resolved with the update

Same as egreshko

All is well. No denials on two machines and relabelling worked on both too.

Please note the selinux policy needs to be rebuilt as a part of the update process so this selinux-policy package update can take a few minutes to complete the rpm scriptlets.

Works for me. Confirmed by two reboots. Scriptlet with restorecon was running 7 minutes!

This update does not resolve #1824196 for me. Also, you can see #1827466 in there as well.

~]# ausearch -m avc -ts boot
----
time->Wed May  6 17:57:42 2020
type=AVC msg=audit(1588805862.874:118): avc:  denied  { read } for  pid=815 comm="sssd" name="systemd" dev="tmpfs" ino=256 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=1
----
time->Wed May  6 17:57:44 2020
type=AVC msg=audit(1588805864.772:163): avc:  denied  { read } for  pid=925 comm="systemd-resolve" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=239 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
----
time->Wed May  6 17:57:44 2020
type=AVC msg=audit(1588805864.772:164): avc:  denied  { open } for  pid=925 comm="systemd-resolve" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=239 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
----
time->Wed May  6 17:57:44 2020
type=AVC msg=audit(1588805864.772:165): avc:  denied  { getattr } for  pid=925 comm="systemd-resolve" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=239 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1

I've tried relabeling then rebooting -- no dice.

@amessina, you are right: the first one missed the build, the second one has not been addressed yet.

@zpytela, thank you. My comment above was a reference that I am still seeing #1824196 even after the update to selinux-policy-3.14.5-38.fc32. It seems like after a reboot, the files are not relabeled in time. After I can login, I run a resstorecon -RFv on /sys/firmware/ and I see the files get relabeled, but that's too late as these errors are generated.

After initrd, I see

systemd[1]: Successfully loaded SELinux policy in 410.073ms. systemd[1]: Relabelled /dev, /dev/shm, /run, /sys/fs/cgroup in 20.904ms.

Should /sys/firmware/efi be listed there as well?

Works fine since 3.14.5-37.fc32. No AVC after reboot.

@amessina, #1824196 dropped out of the latest build, will be a part of the next one.

Please note update to this package version can lead to relabeling the complete filesystem.

The reason is that this update brings file context specification for "/s?bin/arping". Unfortunately, a quantifier so early in the path is replaced with the '' wildcard, i. e. in this case "/" is to be relabeled.