Description of problem:

We are seeing issues where init_t (systemd) is not able to watch directories. This makes path units pretty useless.

According to Dan Walsh: "If init_t can read all file_type directories, it should be able to watch them as well." https://github.com/containers/container-selinux/issues/135#issuecomment-867961079



Can we get selinux updated to allow systemd to watch directories so our path units will work again.

More context in:

https://github.com/coreos/fedora-coreos-tracker/issues/861
https://github.com/containers/container-selinux/issues/135



Version-Release number of selected component (if applicable):

```
[core@localhost ~]$ rpm -q selinux-policy container-selinux
selinux-policy-34.11-1.fc34.noarch
container-selinux-2.163.0-1.fc34.noarch
```


How reproducible:
Always

Steps to Reproduce:

spin up an FCOS machine with this butane config:


```
variant: fcos
version: 1.3.0
systemd:
  units:
    - name: tester.path
      enabled: true
      contents: |
        [Unit]
        Description=Watch for kube config
        [Path]
        PathExists=/etc/kubernetes/kubeconfig
        [Install]
        WantedBy=multi-user.target
    - name: tester.service
      enabled: false
      contents: |
        [Unit]
        Description=Watch for test config
        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=bash -c "echo tester: $(date)"
storage:
  directories:
    - path: /etc/kubernetes
passwd:
  users:
    - name: core
      ssh_authorized_keys:
		- "MY-PUBKEY"
```

Notice that after you log in you can't activate the path unit by creating /etc/kubernetes/kubeconfig and you'll see the following in the journal:

```
$ journalctl | grep -i avc | grep denied
Jul 08 20:50:34 localhost audit[1]: AVC avc:  denied  { watch } for  pid=1 comm="systemd" path="/etc/kubernetes" dev="sda4" ino=18874496 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:kubernetes_file_t:s0 tclass=dir permissive=0
```

We don't have the same problem if we use some randomly directory  (i.e. `/etc/foobar/kubeconfig`).


Actual results:

Denied


Expected results:

Not denied


Additional info: