Bug 2154242

Description of problem:

Since fixing BZ #2118362, we can observe that executing bash from a system cronjob leads to executing in rpm_script_t context, which is not really appropriate.

See below simple reproducer using *runcon* to emulate a system cronjob:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# runcon system_u:system_r:system_cronjob_t:s0 /bin/bash -c "/bin/bash -c 'sleep 1234'"
^Z

# ps -eafZ | grep sleep
system_u:system_r:rpm_script_t:s0 root      2059    1931  0 11:09 pts/0    00:00:00 sleep 1234
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The root cause for this is the following (new) transition rule:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ sesearch -T -s system_cronjob_t | grep rpm_script_t
type_transition system_cronjob_t shell_exec_t:process rpm_script_t;
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Faulty Fedora commit is:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
commit cb33da5ae004343f679e5db4e254061291664046
Author: Zdenek Pytela <zpytela>
Date:   Thu Aug 25 20:31:54 2022 +0200

    Allow system_cronjob_t domtrans to rpm_script_t
    
    This permission is required for rpm-like programs executed from system
    cronjobs, e. g. /etc/crontab.
    
    Resolves: rhbz#2118362
---
 policy/modules/contrib/cron.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/contrib/cron.te b/policy/modules/contrib/cron.te
index c8349c7aa..73d1245df 100644
--- a/policy/modules/contrib/cron.te
+++ b/policy/modules/contrib/cron.te
@@ -544,6 +544,7 @@ ifdef(`distro_redhat',`
 
        # via redirection of standard out.
        optional_policy(`
+               rpm_domtrans_script(system_cronjob_t)
                rpm_manage_log(system_cronjob_t)
        ')
 ')
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The policy (including Fedora policy) contains the following snippets leading to the issue:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
interface(`rpm_domtrans_script',`
        [...]
        # transition to rpm script:
        corecmd_shell_domtrans($1, rpm_script_t)
        [...]
')

interface(`corecmd_shell_domtrans',`
        [...]
        type_transition $1 shell_exec_t:process $2;
')
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

These interfaces, when applied to `system_cronjob_t`, make all `shell_exec_t` processes (typically shells, including `bash`), to transition to `rpm_script_t` if process was executing as `system_cronjob_t`, which is your case here.

This is hence clearly a bug, the rule `rpm_domtrans_script(system_cronjob_t)` is wrong, it should likely be `rpm_domtrans(system_cronjob_t)`, which tells to transition when `/usr/bin/rpm` binary (`rpm_exec_t`) is executed from a system cron.


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-108.el8.noarch

How reproducible:

Always, see above.