Description of problem:

We have a customer trying to use /usr/lib/systemd/systemd-socket-proxyd functionality. The tool is supposed to be able to connect to various sockets since it's supposed to act as a proxy.
Currently it's labeled with *init_exec_t*, hence executes in the context of the caller (systemd), *init_t*, which is hopefully not able to connect to the world.

From the manpage, the tool is supposed to be used as a service ExecStart command.
We need to create a new label for this tool and appropriate transition so that connection to sockets is possible.

Version-Release number of selected component (if applicable):

systemd-239

How reproducible:

Always

Steps to Reproduce:
1. Install telnet-server and nmap-ncat

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# yum -y install telnet-server nmap-ncat
# systemctl start telnet.socket
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. Create a proxy-to-telnet socket (/etc/systemd/system/proxy-to-telnet.socket)

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[Socket]
ListenStream=80

[Install]
WantedBy=sockets.target
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. Create a proxy-to-telnet service (/etc/systemd/system/proxy-to-telnet.service)

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[Unit]
Requires=proxy-to-telnet.socket
After=proxy-to-telnet.socket

[Service]
ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:23
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

4. Start the socket and try connecting to it

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# systemctl daemon-reload
# ncat -t localhost 80
--> "hangs"
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Actual results:

AVC:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# ausearch -i -m avc,user_avc -ts recent
----
type=PROCTITLE msg=audit(05/19/2022 14:58:13.294:365) : proctitle=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:23 
type=SYSCALL msg=audit(05/19/2022 14:58:13.294:365) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0xa a1=0x55e03db88af0 a2=0x10 a3=0x0 items=0 ppid=1 pid=11666 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-socket- exe=/usr/lib/systemd/systemd-socket-proxyd subj=system_u:system_r:init_t:s0 key=(null) 
type=AVC msg=audit(05/19/2022 14:58:13.294:365) : avc:  denied  { name_connect } for  pid=11666 comm=systemd-socket- dest=23 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:telnetd_port_t:s0 tclass=tcp_socket permissive=0 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Expected results:

Telnet connection happening

Additional info:

The workaround is to wrap the call in a shell script stored on /usr/local/bin so that, due to the script being labeled with *bin_t*, a transition to *unconfined_service_t* happens:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# cat /usr/local/bin/systemd-socket-proxyd:
#!/bin/sh
exec /usr/lib/systemd/systemd-socket-proxyd $*
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Example Service (/etc/systemd/system/proxy-to-telnet.service):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[Unit]
Requires=proxy-to-telnet.socket
After=proxy-to-telnet.socket

[Service]
ExecStart=/usr/local/bin/systemd-socket-proxyd 127.0.0.1:23
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------