A new rpm for mode_security F12 simplified the rules to get it started.
In the conf files the logs directive say to specify the path to the dir and make sure it exits.
As this dir list shows ther are several.
The suggested top dir is /var/log/msa
Does anyone know which sebool it is to allow httpd write access to /home/user/html?
When I disable selinux echo 0 > /selinux/enforce I can write, so definitely selinux. Just don't know which one is the right one without opening a big hole and Google isn't being much help.