Bug 1834234

If the /usr/sbin/nfsdcld file is labeled nfsd_exec_t then the service does not start and following SELinux denial appears:

----
type=PROCTITLE msg=audit(05/11/2020 14:59:37.182:1455) : proctitle=/usr/sbin/nfsdcld 
type=SYSCALL msg=audit(05/11/2020 14:59:37.182:1455) : arch=x86_64 syscall=prctl success=no exit=EPERM(Operation not permitted) a0=PR_CAPBSET_DROP a1=chown a2=0x0 a3=0x0 items=0 ppid=1 pid=34260 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=nfsdcld exe=/usr/sbin/nfsdcld subj=system_u:system_r:nfsd_t:s0 key=(null) 
type=AVC msg=audit(05/11/2020 14:59:37.182:1455) : avc:  denied  { setpcap } for  pid=34260 comm=nfsdcld capability=setpcap  scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:nfsd_t:s0 tclass=capability permissive=0 
----

If the /usr/sbin/nfsdcld file is labeled rpcd_exec_t then there are no SELinux denials and the service starts successfully:

# service nfsdcld status
Redirecting to /bin/systemctl status nfsdcld.service
● nfsdcld.service - NFSv4 Client Tracking Daemon
     Loaded: loaded (/usr/lib/systemd/system/nfsdcld.service; static; vendor preset: disabled)
     Active: active (running) since Mon 2020-05-11 14:59:55 CEST; 2min 12s ago
    Process: 34310 ExecStart=/usr/sbin/nfsdcld (code=exited, status=0/SUCCESS)
   Main PID: 34311 (nfsdcld)
      Tasks: 1 (limit: 2330)
     Memory: 932.0K
        CPU: 3ms
     CGroup: /system.slice/nfsdcld.service
             └─34311 /usr/sbin/nfsdcld

May 11 14:59:55 localhost.localdomain systemd[1]: Starting NFSv4 Client Tracking Daemon...
May 11 14:59:55 localhost.localdomain systemd[1]: Started NFSv4 Client Tracking Daemon.
# ps -efZ | grep nfsdcld
system_u:system_r:rpcd_t:s0     root       34311       1  0 14:59 ?        00:00:00 /usr/sbin/nfsdcld
#

If the /usr/sbin/nfsdcld file is labeled rpcd_exec_t then there is still a AVC there:

avc:  denied  { read } for  pid=20465 comm="nfsdcld" name="nfsv4recoverydir" dev="nfsd" ino=18 scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file permissive=0

I propose this fix:

PR:https://github.com/fedora-selinux/selinux-policy-contrib/pull/324

Link to scratch build: https://download.copr.fedorainfracloud.org/results/rfilo/Selinux-policy-f32/fedora-32-x86_64/01613374-selinux-policy/

commit 07c22d0d3a2f2c4e7a4d11da285e7eb3167a33e2 (HEAD -> f32, origin/f32)
Author: Richard Filo <rfilo>
Date:   Mon Aug 10 09:19:56 2020 +0200

    The nfsdcld service is now confined by SELinux
    
    The nfsdcld service is confined by rpcd_t domain.
    Allow rpcd_t domain to read files on an nfsd filesystem.
    
    fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1834234

FEDORA-2020-740de661da has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-740de661da

FEDORA-2020-740de661da has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-740de661da`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-740de661da

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2020-740de661da has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.