Description of problem:

When oddjob-mkhomedir is executed from the cron daemon, it fails to create the user's home directory.
The following AVC and USER_AVC are seen:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

type=USER_AVC msg=audit(1545054661.514:262): pid=612 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=error error_name=com.redhat.oddjob.Error.Exec dest=:1.37 spid=26993 tpid=26994 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE msg=audit(1545054661.511:261): proctitle=2F7573722F7362696E2F6F64646A6F6264002D6E002D70002F7661722F72756E2F6F64646A6F62642E706964002D7400333030
type=SYSCALL msg=audit(1545054661.511:261): arch=c000003e syscall=59 success=no exit=-13 a0=55fb5d3800a0 a1=55fb5d381b90 a2=55fb5d390340 a3=3a30732d30733a74 items=0 ppid=26993 pid=26996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1545054661.511:261): avc:  denied  { transition } for  pid=26996 comm="oddjobd" path="/usr/libexec/oddjob/mkhomedir" dev="dm-0" ino=8703477 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=process
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

audit2allow proposes to add the following and prints an odd message related to mislabeling:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
#============= oddjob_t ==============
allow oddjob_t crond_t:dbus send_msg;

#!!!! The file '/usr/libexec/oddjob/mkhomedir' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v /usr/libexec/oddjob/mkhomedir
allow oddjob_t crond_t:process transition;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


If I add the latter to a custom policy, then oddjob will continue to fail with the following AVC:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE msg=audit(1545056341.770:510): proctitle=2F7573722F7362696E2F6F64646A6F6264002D6E002D70002F7661722F72756E2F6F64646A6F62642E706964002D7400333030
type=SYSCALL msg=audit(1545056341.770:510): arch=c000003e syscall=59 success=no exit=-13 a0=55fb5d3800a0 a1=55fb5d38d680 a2=55fb5d38a770 a3=3a30732d30733a74 items=0 ppid=26993 pid=29759 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1545056341.770:510): avc:  denied  { entrypoint } for  pid=29759 comm="oddjobd" path="/usr/libexec/oddjob/mkhomedir" dev="dm-0" ino=8703477 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:oddjob_mkhomedir_exec_t:s0 tclass=file
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-192.el7_5.7.noarch and selinux-policy-3.13.1-229.el7_6.6.100.noarch


How reproducible:

Always


Steps to Reproduce:
1. Install and enable oddjob-mkhomedir

  yum -y install oddjob-mkhomedir
  authconfig --update --enablemkhomedir

2. Create a user without home dir

  useradd -M renaud

3. Add a cron entry to the user

  crontab -u renaud -e
  <vi opens>
  * * * * * ls -l

4. Wait for 1 minute and check audit


Actual results:

- AVC + USER_AVC
- no /home/renaud created


Expected results:

- /home/renaud created


Additional info:

Doesn't happen on RHEL8