Symbolic links do not allow SELinux type_transition

Question

Trying to access symbolic link does not allow to use SELinux type_transition. I mean that I tried to implement scheme in which user has access to a symbolic link located in /usr/bin/ and which leads to the binary file placed in a closed for the user directory. The original binary (executable) file and the symbolic link to it have the same SELinux contexts to which user has rights for executing, reading and some others (see below), although the user does not have access rights to the directory where the original binary file is located so the user can’t open or search this directory. If the user has type “seuser_test_libre_writer_two_t” than the policy for this particular application (binary file) will look like this TE:

policy_module(test, 1.0.0)
require {
  type seuser_test_libre_writer_two_t;
  class file { getattr relabelto unlink execute append read setattr 
               write create open rename execute_no_trans entrypoint 
               ioctl lock };
  class dir { getattr relabelfrom relabelto read open setattr write 
              create rename search rmdir add_name };
  class process { transition rlimitinh siginh sigchld noatsecure };
  class lnk_file { read getattr };
  role seuser_test_libre_writer_two_r;
}

type selinux_object_hw_test_t;
type selinux_file_hw_test_exec_t;

role seuser_test_libre_writer_two_r types selinux_object_hw_test_t;

type_transition seuser_test_libre_writer_two_t 
                selinux_file_hw_test_exec_t: process 
                selinux_file_hw_test_exec_t;

allow seuser_test_libre_writer_two_t selinux_file_hw_test_exec_t: 
process { transition };

allow selinux_file_hw_test_exec_t selinux_file_hw_test_exec_t: file { 
      execute read write };
allow seuser_test_libre_writer_two_t selinux_file_hw_test_exec_t: file 
      { execute getattr open read };

allow selinux_file_hw_test_exec_t selinux_object_hw_test_t: dir { 
      search getattr };
allow seuser_test_libre_writer_two_t selinux_file_hw_test_exec_t: 
      lnk_file { read };

FC:

/opt/test -d gen_context(system_u:object_r:selinux_object_hw_test_t)

/usr/bin/hello_world_link -l 
gen_context(system_u:object_r:selinux_file_hw_test_exec_t)
/opt/test/hw -- 
gen_context(system_u:object_r:selinux_file_hw_test_exec_t)

And when I am trying to run my application I’ve got access deny and avc in /var/log/audit/audit.log demanding me to give the user access to the directory where the original file is located.

type=AVC msg=audit(1545644823.820:11488): avc:  denied  { search } for     pid=12976 comm="bash" name="test" dev="dm-0" ino=2102570 scontext=seuser_test_libre_writer_two_u:seuser_test_libre_writer_two_r:seuser_test_libre_writer_two_t:s0 tcontext=system_u:object_r:selinux_object_hw_test_t:s0 tclass=dir

Is it possible to use SELinux "type_transition" with symlinks?

I checked these links "How does linux work with symbolic links?", "Maintaining file's SELinux labels when copying them from one directory into another", "SELinux: home dir is symlink, httpd from files in home dir" and "Can't apply SELinux file context to paths with symlinks" but they are not completely related to the question.

Answer 1

This is not possible, you need to create a wrapper or a real copy of the original binary.