How to run an Android init service with superuser SELinux context?
Here the error is:

audit: type=1400 audit(1560142274.289:131): avc: denied { transition } for pid=8035 comm="init" path="/system/bin/custom.sh" dev="sda24" ino=8146 scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process permissive=0


In easy words it states that init is running with its context u:r:init:0, you want it to execute /system/bin/custom.sh with context u:r:su:s0, but it's not allowed in sepolicy.

Rooting a phone gets two things: UID 0 (which you have) and an unrestricted SELinux context (which you don't have). Magisk allows any other context to do anything with its own contexts (u:r:magisk:s0 and u:object_r:magisk:s0). And it can do anything to any other context. See details in this answer.

u:r:su:s0 is a limited context which doesn't allow init to make transition to itself. Only adb can do this on userdebug or eng builds of a ROM. See reference and this answer for details.

Possible solutions:


Run service in init's context if it doesn't need to access any resources which init isn't allowed to access. But in most cases it's highly unlikely.
Root your device with Magisk and run service with u:r:magisk:s0 context as explained in this answer.
Modify your SELinux policy to allow this transition. Inject the following statement to sepolicy using magiskpolicy or sepolicy-inject:

~# magiskpolicy --live 'allow init su process transition'
~# sepolicy-inject -s init -t su -c process -p transition -l


Also see dmesg for any other denials. As a reference, on my device init is allowed to do following operations to Magisk:

allow init magisk : process { fork transition sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent execmem execstack execheap setkeycreate setsockcreate getrlimit }
allow init magisk : fifo_file { read write getattr open }
allow init magisk : fd use
allow init magisk : unix_stream_socket { getopt connectto }
allow init magisk : binder { impersonate call set_context_mgr transfer }


Then extract boot.img and ramdisk (only on non-system-as-root devices), replace /sepolicy with new policy file copied from /sys/fs/selinux/policy, repack boot.img and flash back.
Set SELinux permissive

From root adb shell do echo -n 0 &gt;/sys/fs/selinux/enforce or setenforce 0. However this is not permanent and will be set to enforced on boot. init can't set it permissive. Also setting SELinux permissive is a security risk and hence never recommended.