I am writing SE Linux policy for the needrestart utility which runs the debconf
frontend program.

When it runs I see the following error message:
debconf: DbDriver "templatedb": could not write /var/cache/debconf/templates.dat-new: Permission denied

Firstly due to it's nature needrestart won't have anything to write to the
templates.dat file.

Next here is an extract from the strace output:
str.9334:openat(AT_FDCWD, "/var/cache/debconf/templates.dat", O_RDWR|O_CLOEXEC) = -1 EACCES (Permission denied)
str.9334:openat(AT_FDCWD, "/var/cache/debconf/templates.dat", O_RDONLY|O_CLOEXEC) = 4

So when it reads the data it sees that RDWR access isn't allowed, opens it
read-only and doesn't report this as an error.  So by then it should know
that writing is inappropriate as well as being unneeded and not report it
as a problem.