Description of problem:

When iptables gets executed through cloud-init.service, the /run/xtables.lock file gets created with context "var_run_t" instead of "iptables_var_run_t".

This is due to not having the proper transition in the policy, the following is missing:

type_transition cloud_init_t var_run_t:file iptables_var_run_t "xtables.lock"; 


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-229.el7_6.9.noarch


How reproducible:

Always


Steps to Reproduce:
1. Create a fake cloud-init service calling iptables internally

# cat > /usr/local/bin/cloud-init << EOF
#!/bin/bash
iptables -F
EOF

# chmod +x /usr/local/bin/cloud-init
# chcon -t cloud_init_exec_t /usr/local/bin/cloud-init

# cat > /etc/systemd/system/cloud-init.service << EOF
[Service]
Type=oneshot
ExecStart=/usr/local/bin/cloud-init
EOF

2. Execute the service

# /bin/rm /run/xtables.lock || true
# systemctl daemon-reload
# systemctl start cloud-init

3. Check the context

# ls -Z /run/xtables.lock

Actual results:

-rw-------. root root system_u:object_r:var_run_t:s0   /run/xtables.lock


Expected results:

-rw-------. root root system_u:object_r:iptables_var_run_t:s0   /run/xtables.lock


Additional info:

This is already fixed in RHEL8.0, through adding a transition rule for a very large number of process contexts, including "cloud_init_t".