Dear Maintainer,

Running radvd on Debian 9.2 with systemd and selinux enabled results in radvd
running in wrong selinux context.

This is what I get, radvd running in init_t context:

# ps -auxZ | grep radvd
system_u:system_r:init_t:s0    root     11139  0.5  0.6   2580  1628 ?
S<s  00:27   0:00 /usr/sbin/radvd --logmethod stderr_clean

This is what /var/log/audit.log says about this:

# cat /var/log/audit/audit.log | grep radvd
type=SELINUX_ERR msg=audit(1511047441.963:10594):
op=security_bounded_transition seresult=denied
oldcontext=system_u:system_r:init_t:s0 newcontext=system_u:system_r:radvd_t:s0

This is what I would expect, radvd running in radvd_t context:
# ps -auxZ | grep radvd
system_u:system_r:radvd_t:s0    root     11139  0.5  0.6   2580  1628 ?
S<s  00:27   0:00 /usr/sbin/radvd --logmethod stderr_clean

It turns out that the option

NoNewPrivileges=yes

in /lib/systemd/system/radvd.service causes the transition denial from init_t
to radvd_t context.

Turning off this option by either creating a .service file in
/etc/systemd/system/ that runs radvd via /etc/init.d/radvd script, or creating
a file /etc/systemd/system/radvd.service.d/extend.conf that overrides this
option and sets the value to no resolves this issue.

This might be either a systemd or selinux or selinux-policy bug rather than a
bug in radvd.