Description of problem:

There are many cases where executing a command with sudo as a confined sysadm user doesn't work, usually most command executed as shown below:

$ sudo <program> <args...>

e.g.

$ sudo passwd

The root cause are missing contexts or transitions from "sysadm_sudo_t" (context of "sudo") to appropriate context (e.g. "passwd_t" through "passwd_exec_t" file).
With time, engineering comes up with adding more rules for domains, but since customers use very customized configuration, the policy is always late.

Last reported issue is with "passwd" when using cracklib database:
When executing "sudo passwd", the cracklib database cannot be read because "passwd" command executes in the context of "sudo" (sysadm_sudo_t) instead of "passwd (passwd_t").

As shown in the example below:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE ... : proctitle=passwd <USERNAME> 
type=PATH ... : item=0 name=/usr/share/cracklib/pw_dict.pwd.gz ... mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:crack_db_t:s0 ...
type=SYSCALL ... : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x7ffde70cf450 a1=O_RDONLY ... uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root ... comm=passwd exe=/usr/bin/passwd subj=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 ...
type=AVC ... : avc:  denied  { read } for  pid=13672 comm=passwd name=pw_dict.pwd.gz ... scontext=sysadm_u:sysadm_r:sysadm_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:crack_d _t:s0 tclass=file permissive=0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Version-Release number of selected component (if applicable):

RHEL8.3 policy, RHEL7.9 policy


How reproducible:

Always when using crack library.

Additional info:

We need to fix the policy again and again.
Note that I filed a RFE against sudo to always use the "SELinux aware" code: BZ #1910077
Implementing this RFE would solve **ALL** "sudo <command>" issues.