Bug 1920883

Description of problem:

With current policy, it's not possible for a confined user (e.g. staff_u) to execute a script labeled with user_tmp_t using sudo:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ sudo /var/tmp/foo 
sudo: unable to execute /var/tmp/foo: Permission denied
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The reason is "entrypoint" rule is missing e.g. "sysadm_t user_tmp_t:file { entrypoint }" doesn't exist.

All the other rules are there, in particular transitions from sudo (e.g. sysadm_sudo_t) to sysadm_t upon executing a user_tmp_t file:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# sesearch -T -s sudodomain -t user_tmp_t 
type_transition auditadm_sudo_t user_tmp_t:process auditadm_t;
type_transition dbadm_sudo_t user_tmp_t:process dbadm_t;
type_transition secadm_sudo_t user_tmp_t:process secadm_t;
type_transition staff_sudo_t user_tmp_t:process staff_t;
type_transition sysadm_sudo_t user_tmp_t:process sysadm_t;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-54.el8.noarch


How reproducible:

ALWAYS

Steps to Reproduce:
1. Create a confined user that can sudo

  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  # useradd -Z sysadm_u -G wheel sysadm
  # echo "pass" | passwd --stdin sysadm
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. Create a script in /var/tmp

  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  # cat > /var/tmp/foo << EOF
  #!/bin/sh
  echo "Hello"
  EOF

  # chmod +x /var/tmp/foo
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. Log in as the confined user and execute sudo

  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  # ssh sysadm@localhost
  $ id -Z
  sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023
  $ sudo /var/tmp/foo
  [sudo] password for sysadm: 
  sudo: unable to execute /var/tmp/foo: Permission denied
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Actual results: AVC on "entrypoint"

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
time->Wed Jan 27 08:25:37 2021
type=PROCTITLE msg=audit(1611732337.758:5489): proctitle=7375646F002F7661722F746D702F666F6F
type=PATH msg=audit(1611732337.758:5489): item=0 name="/var/tmp/foo" inode=33576115 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1611732337.758:5489): cwd="/home/sysadm"
type=SYSCALL msg=audit(1611732337.758:5489): arch=c000003e syscall=59 success=no exit=-13 a0=5650943e4a48 a1=5650944117d8 a2=5650944cd4e0 a3=0 items=1 ppid=4193 pid=4197 auid=1011 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="sudo" exe="/usr/bin/sudo" subj=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 key="EXECVE"
type=AVC msg=audit(1611732337.758:5489): avc:  denied  { entrypoint } for  pid=4197 comm="sudo" path="/var/tmp/foo" dev="dm-0" ino=33576115 scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Expected results:

Script execution and no AVC

Additional info:

There are 2 workarounds:
1. sudo sh -c /var/tmp/foo
2. sudo -r sysadm_r /var/tmp/foo