SELinux blocks timedatectl to update timezone, SELinux script to unblock it

selinux_policy_timedated.txt

# timedatectl set-timezone Europe/Berlin
Failed to set time zone: Access denied

# grep denied /var/log/audit/audit.log
type=AVC msg=audit(1530808024.058:35494): avc:  denied  { unlink } for  pid=32035 comm="systemd-timedat" name="localtime" dev="vda1" ino=74 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file

# cat /var/log/audit/audit.log | audit2allow -M timezone

#============= systemd_timedated_t ==============

#!!!! WARNING: 'etc_t' is a base type.
allow systemd_timedated_t etc_t:lnk_file unlink;


I modified the resulting timezone.te because it contained other things
# timezone.te

module timezone 1.0;

require {
        type systemd_timedated_t;
        type etc_t;
        class lnk_file unlink;
        class system module_request;
}




# checkmodule -M -m -o timezone.mod timezone.te
# semodule_package -o timezone.pp -m timezone.mod
# semodule -i timezone.pp


# timedatectl set-timezone Europe/Berlin

# timedatectl 
...
       Time zone: Europe/Berlin (CEST, +0200)