The Target Context of system_u:object_r:unlabeled_t:s0 is a likely cause. There may be a rule to allow scontext=system_u:system_r:syslogd_t:s0 to perform actions on files of type syslogd_var_lib_t, which is what I think the SELinux context should be for the /var/lib/rsyslog/imjournal.state file. On my system, there's an fcontext rule that sets it:
/var/lib/r?syslog(/.*)? all files system_u:object_r:syslogd_var_lib_t:s0
The fix may be as simple as restorecon -v /var/lib/rsyslog/imjournal.state, followed up with a confirmation check of ls -lZ /var/lib/rsyslog/imjournal.state.
I don't have a Fedora system at-hand to confirm this, so you confirm the theory by checking the allowed actions between a source context of syslogd_t (shown in the audit) and a target context of syslogd_var_lib_t:
sesearch --allow -s syslogd_t -t syslogd_var_lib_t
as well as looking for fcontext rules:
semanage fcontext -l | grep 'syslog.*syslogd_var_lib_t'
If I'm correct, you'll see:
Found 8 semantic av rules:
...
allow syslogd_t syslogd_var_lib_t : file { ioctl read write create getattr setattr lock append map unlink link rename open } ;
...
... in the sesearch output, and:
...
/var/lib/r?syslog(/.*)? all files system_u:object_r:syslogd_var_lib_t:s0
...
... in the semanage output.
If you don't have the sesearch command by default, it should be available in an "setools" or "setools-console" package.
