Description of problem:

When an executable is in /home/user/bin and a systemd unit file attempts to run it, we fail with AVC denial:

# ausearch -i -m avc,user_avc
----
type=AVC msg=audit(07/24/2020 10:40:46.402:762) : avc:  denied  { execute } for  pid=5221 comm=(test.sh) name=test.sh dev="dm-0" ino=8424005 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:home_bin_t:s0 tclass=file permissive=0

Version-Release number of selected component (if applicable):

RHEL 8

How reproducible:

Every time


Steps to Reproduce:
1. mkdir /home/user/bin
2. Create executable:

    # cat /home/vagrant/bin/test.sh 
    #!/bin/bash

    echo 'test'

3. Create systemd unit file:

    # cat /etc/systemd/system/test.service 
    [Service]
    ExecStart=/home/vagrant/bin/test.sh

4. systemd daemon-reload; systemd start test.service

Actual results:

AVC denial:

    type=AVC msg=audit(07/24/2020 10:40:46.402:762) : avc:  denied  { execute } for  pid=5221 comm=(test.sh) name=test.sh dev="dm-0" ino=8424005 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:home_bin_t:s0 tclass=file permissive=0

Expected results:

systemd should be able to run an executable in a user's bin home without AVC.

Additional info:

This can be worked around by wrapping the executable in a shell so it's bin_t instead of init_t:

    # cat /etc/systemd/system/test.service 
    [Service]
    ExecStart=/bin/sh -c '/home/vagrant/bin/test.sh'