Description of problem:

Confined users mapped to sysadm_u SELinux user cannot execute "service xxx status" or "service xxx restart" commands, as shown in the examples below:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[sysadm@vm-confined79 ~]$ service network status
env: /etc/init.d/network: Permission denied
[sysadm@vm-confined79 ~]$ service rhnsd status
env: /etc/init.d/rhnsd: Permission denied
[sysadm@vm-confined79 ~]$ service rhnsd restart
env: /etc/init.d/rhnsd: Permission denied
[sysadm@vm-confined79 ~]$ service network restart
env: /etc/init.d/network: Permission denied
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The root cause is missing rules to allow the transition to initrc_t to happen when "service" internally executes /etc/rc.d/init.d/xxx script.


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-268.el7_9.2.noarch


How reproducible:

Always

Steps to Reproduce:
1. Map a user to sysadm_u
2. Try executing "service xxx status" commands (see description above)

Actual results:

AVC:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=AVC msg=audit(1641968146.839:743): avc:  denied  { entrypoint } for  pid=5391 comm="env" path="/etc/rc.d/init.d/network" dev="dm-0" ino=17429529 scontext=sysadm_u:system_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=file permissive=0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Expected results:

No AVC and proper execution


Additional info:

Note that "service xxx status" can be different than "systemctl status xxx" for SysV initscripts: it's SysV initscript implementation dependent, e.g. "service network status" output is different than "systemctl status network".
Hence using "systemctl status xxx" cannot be considered as a workaround.

The solution seems to allow the transition through adding the below rule:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
init_all_labeled_script_domtrans(sysadm_t)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Please CONFIRM this is safe and the proper way to allow execution.