Description
On a minion with SELinux enabled, a cmd.run execution with argument runas is going to produce an ERROR in the Salt logs and a denied message in the audit logs:

Salt logs:

2024-07-29 16:33:52,879 [salt.loaded.int.module.cmdmod:587 ][ERROR   ][3389] Environment could not be retrieved for user 'nobody': stderr='su: failed to execute /bin/bash: Permission denied\n' stdout=''

Audit logs:

type=AVC msg=audit(1722874387.581:120): avc:  denied  { transition } for  pid=3219 comm="su" path="/usr/bin/bash" dev="vda3" ino=8730 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0

These errors are produced by salt-minion service when trying to get the environment variables user targetted via runas. The way Salt is getting the complete set of environment variables for the user is causing a transition between unconfined_service_t and unconfined_t which is NOT allowed.

The actual execution of the command targetted via cmd.run is actually fine (as long as you don't rely on missing environment variables).

IMPORTANT: This error is only seen when salt-minion is a service started by systemd, as it gets unconfined_service_t context. It doesn't happen if salt-minion is executed manually or salt-call is used.

Setup
(Please provide relevant configs and/or SLS files (be sure to remove sensitive info. There is no general set-up of Salt.)

Please be as specific as possible and give set-up details.

• on-prem machine
• VM (KVM)
• VM running on a cloud service, please be explicit and add details
• container (Kubernetes, Docker, containerd, etc. please specify)
• or a combination, please be explicit
• jails if it is FreeBSD
• classic packaging
• onedir packaging
• used bootstrap to install

Steps to Reproduce the behavior

Having MINION being a SELinux enabled environment, enforcing mode ON:

minion # su -c env nobody
[... all expected environment variables ...]

master # salt MINION cmd.run env runas=nobody
[... NOT all expected environment variables ..]

An ERROR message is produced in the Salt logs and denied AVC message on /var/log/audit.log.

Expected behavior

Having MINION being a SELinux enabled environment, enforcing mode ON:

minion # su -c env nobody
[... all expected environment variables ...]

master # salt MINION cmd.run env runas=nobody
[... all expected environment variables ...]

No denied message seen.

Versions Report

</details>

**Additional context**
Add any other context about the problem here.