Bug 1907517

Description of problem:
According to the RHEL SELinux documentation, Linux user mapped into SELinux 'user_u' shouldn't be able to use "su" or "sudo". 

Version-Release number of selected component (if applicable):
rhel-8.3

[root@localhost ~]# rpm -qa | grep -i selinux-policy
selinux-policy-targeted-3.14.3-54.el8.noarch
selinux-policy-3.14.3-54.el8.noarch


How reproducible:

1. Add a user test.
2. echo "password" | passwd --stdin test.
3. # cat /etc/sudoers | grep -i test
test	ALL=(ALL) 	ALL
4. Then login using test user via ssh. test user is able to because root as below:

[test@localhost ~]$ whoami 
test

[test@localhost ~]$ id -Z
user_u:user_r:user_t:s0

[test@localhost ~]$ sudo -i 
sudo: unable to open /run/sudo/ts/test: Permission denied

[sudo] password for test: 
sudo: unable to stat /var/db/sudo: Permission denied
-bash: /root/.bash_profile: Permission denied

[root@localhost ~]# whoami 
root

[root@localhost ~]# id -Z
user_u:user_r:user_t:s0
~~~~

Actual results:
test user became root 


Expected results:
test user shouldn't get root permissions


Additional info:
This has been tested on rhel-8.0 as well and it works properly ( blocking access ):

# rpm -qa | grep -i selinux
selinux-policy-3.14.1-61.el8.noarch
selinux-policy-targeted-3.14.1-61.el8.noarch

$ sudo -i
sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
sudo: no valid sudoers sources found, quitting
sudo: setresuid() [0, 0, 0] -> [1001, -1, -1]: Operation not permitted
sudo: unable to initialize policy plugin