$ rpm -qi libsepol
Name        : libsepol
Version     : 2.5
Release     : 10.el7
Architecture: x86_64
Install Date: Sat 29 Jun 2019 05:27:14 PM CST
Group       : System Environment/Libraries
Size        : 686640
License     : LGPLv2+
Signature   : RSA/SHA256, Mon 12 Nov 2018 10:37:35 PM CST, Key ID 24c6a8a7f4a80eb5
Source RPM  : libsepol-2.5-10.el7.src.rpm
Build Date  : Wed 31 Oct 2018 05:36:15 AM CST
Build Host  : x86-01.bsys.centos.org
...
$ ldd /usr/libexec/selinux/hll/pp
        linux-vdso.so.1 =>  (0x00007ffdd8fae000)
        libsepol.so.1 => /lib64/libsepol.so.1 (0x00007ff110721000)
        libc.so.6 => /lib64/libc.so.6 (0x00007ff110353000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff110bc2000)

$ cat libceph.te
policy_module(libceph, 1.0.0)

# refpolicy/policy/support/obj_perm_sets.spt
# https://github.com/SELinuxProject/refpolicy/blob/RELEASE_2_20190609/policy/support/obj_perm_sets.spt

### /var/run/ceph

optional {
require {
    type virtd_t;
    type var_run_t;
}

allow virtd_t var_run_t:dir rw_dir_perms;
allow virtd_t var_run_t:sock_file manage_sock_file_perms;
}

optional {
require {
    type virtd_t;
    type ceph_var_run_t;
}

allow virtd_t ceph_var_run_t:dir rw_dir_perms;
allow virtd_t ceph_var_run_t:sock_file manage_sock_file_perms;
}

optional {
require {
    type svirt_t;
    type var_run_t;
}

allow svirt_t var_run_t:dir rw_dir_perms;
allow svirt_t var_run_t:sock_file manage_sock_file_perms;
}

optional {
require {
    type svirt_t;
    type ceph_var_run_t;
}

allow svirt_t ceph_var_run_t:dir rw_dir_perms;
allow svirt_t ceph_var_run_t:sock_file manage_sock_file_perms;
}

### /var/log/ceph

optional {
require {
    type virtd_t;
    type var_log_t;
}

allow virtd_t var_log_t:dir rw_dir_perms;
allow virtd_t var_log_t:file manage_file_perms;
}

optional {
require {
    type virtd_t;
    type ceph_var_log_t;
}

allow virtd_t ceph_var_log_t:dir rw_dir_perms;
allow virtd_t ceph_var_log_t:file manage_file_perms;
}

optional {
require {
    type svirt_t;
    type var_log_t;
}

allow svirt_t var_log_t:dir rw_dir_perms;
allow svirt_t var_log_t:file manage_file_perms;
}

optional {
require {
    type svirt_t;
    type ceph_var_log_t;
}

allow svirt_t ceph_var_log_t:dir rw_dir_perms;
allow svirt_t ceph_var_log_t:file manage_file_perms;
}

$ ls
libceph.pp
$ /usr/libexec/selinux/hll/pp libceph.pp libceph.cil
$ ls
libceph.cil  libceph.pp

$ cat libceph.cil
(roleattributeset cil_gen_require system_r)
(optional libceph_optional_2
    (typeattributeset cil_gen_require virtd_t)
    (typeattributeset cil_gen_require var_run_t)
    (allow virtd_t var_run_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow virtd_t var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_3
    (typeattributeset cil_gen_require virtd_t)
    (typeattributeset cil_gen_require ceph_var_run_t)
    (allow virtd_t ceph_var_run_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow virtd_t ceph_var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_4
    (typeattributeset cil_gen_require var_run_t)
    (typeattributeset cil_gen_require svirt_t)
    (allow svirt_t var_run_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow svirt_t var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_5
    (typeattributeset cil_gen_require ceph_var_run_t)
    (typeattributeset cil_gen_require svirt_t)
    (allow svirt_t ceph_var_run_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow svirt_t ceph_var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_6
    (typeattributeset cil_gen_require virtd_t)
    (typeattributeset cil_gen_require var_log_t)
    (allow virtd_t var_log_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow virtd_t var_log_t (file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_7
    (typeattributeset cil_gen_require virtd_t)
    (typeattributeset cil_gen_require ceph_var_log_t)
    (allow virtd_t ceph_var_log_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow virtd_t ceph_var_log_t (file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_8
    (typeattributeset cil_gen_require svirt_t)
    (typeattributeset cil_gen_require var_log_t)
    (allow svirt_t var_log_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow svirt_t var_log_t (file (ioctl read write create getattr setattr lock append unlink link rename open)))
)
(optional libceph_optional_9
    (typeattributeset cil_gen_require svirt_t)
    (typeattributeset cil_gen_require ceph_var_log_t)
    (allow svirt_t ceph_var_log_t (dir (ioctl read write getattr lock add_name remove_name search open)))
    (allow svirt_t ceph_var_log_t (file (ioctl read write create getattr setattr lock append unlink link rename open)))
)

$ sudo semodule -X 400 -i libceph.cil
$ sudo semodule -lfull | grep libceph
400 libceph           cil