I've found out that in addition to what we discovered, two following rules are needed:

#============= httpd_t ==============

#!!!! This avc can be allowed using the boolean 'httpd_run_stickshift'
allow httpd_t oddjob_t:dbus send_msg;

#============= oddjob_t ==============

#!!!! This avc can be allowed using the boolean 'httpd_run_stickshift'
allow oddjob_t httpd_t:dbus send_msg;

It would probably be better to add them directly to the policy.

Does it work better when you enable the httpd_run_stickshift boolean?

# setsebool httpd_run_stickshift on

Following command enables the boolean permanently (survives the reboot):

# setsebool -P httpd_run_stickshift on

It should work with it, yes, but I need fully working policy and Miroslav is working on that -- I'm documenting the parts that are discovered when I run my updated code for the helper.

Mirek, 

Whats the state of this issue?

Current policy as developed by Mirek:

policy_module(myipa,1.0)

type ipa_helper_t;
type ipa_helper_exec_t;
domain_type(ipa_helper_t)
domain_obj_id_change_exemption(ipa_helper_t)
init_system_domain(ipa_helper_t, ipa_helper_exec_t)
oddjob_system_entry(ipa_helper_t, ipa_helper_exec_t)

require{
    type unconfined_t;
    role unconfined_r;
    }

domtrans_pattern(unconfined_t,ipa_helper_exec_t,ipa_helper_t)
role unconfined_r types ipa_helper_t;


allow ipa_helper_t self:capability { dac_override };

allow ipa_helper_t self:process setfscreate;
allow ipa_helper_t self:fifo_file rw_fifo_file_perms;
allow ipa_helper_t self:netlink_route_socket r_netlink_socket_perms;

kernel_read_system_state(ipa_helper_t)

corenet_tcp_connect_smbd_port(ipa_helper_t)

corecmd_exec_bin(ipa_helper_t)
corecmd_exec_shell(ipa_helper_t)

dev_read_urand(ipa_helper_t)

auth_use_nsswitch(ipa_helper_t)

ipa_manage_pid_files(ipa_helper_t)
ipa_read_lib(ipa_helper_t)

logging_send_syslog_msg(ipa_helper_t)

optional_policy(`
    samba_read_config(ipa_helper_t)
')

optional_policy(`
    sssd_manage_lib_files(ipa_helper_t)
')

optional_policy(`
    ldap_stream_connect(ipa_helper_t)
')

optional_policy(`
    memcached_stream_connect(ipa_helper_t)
')


This policy lacks few rules. Note that they are a bit different when you run helper as root and as apache because oddjobd actually knows about SELinux and propagates the context of caller to the helper:

#============= httpd_t ==============
allow httpd_t ipa_helper_exec_t:file entrypoint;
allow httpd_t ipa_var_lib_t:file { read getattr open };
allow httpd_t ipa_var_run_t:dir { write remove_name add_name };
allow httpd_t ipa_var_run_t:file { write setattr read lock create unlink open };
allow httpd_t oddjob_t:fifo_file write;
allow httpd_t oddjob_t:process sigchld;

#============= oddjob_t ==============
allow oddjob_t httpd_t:process transition;

#============= ipa_helper_t ==============
allow ipa_helper_t ipa_var_lib_t:file { read getattr open };

#!!!! This avc can be allowed using one of the these booleans:
#     nis_enabled, authlogin_nsswitch_use_ldap
allow ipa_helper_t ldap_port_t:tcp_socket name_connect;
allow ipa_helper_t ldconfig_exec_t:file { read execute open execute_no_trans };

Two more elements after a clean run:
allow httpd_t sssd_var_lib_t:dir { write add_name };
allow httpd_t sssd_var_lib_t:file { write create setattr };

I don't like that there is httpd_t context propagation, though. I'd prefer to have everything under ipa_helper_t...

Looking into oddjobd code, I can see that it computes execution context based on the caller context and the context of the file:

			client_secontext = oddjob_dbus_message_get_selinux_context(msg);
			if (client_secontext == NULL) {
				/* Wha....? */
				exec_errno = 0xff;
				write(3, &exec_errno, 1);
				_exit(-1);
			}
			if (getfilecon(method->argv[0], &helper_context) == -1) {
				switch (errno) {
				/* Not there? */
				case ENOENT:
					exec_errno = errno;
					break;
				default:
					/* No label? */
					exec_errno = 0xfd;
					break;
				}
				write(3, &exec_errno, 1);
				_exit(-1);
			}
			if (security_compute_create((char *) client_secontext,
						    helper_context,
						    SECCLASS_PROCESS,
						    &exec_context) != 0) {
				/* Failed to compute exec context? */
				exec_errno = 0xfe;
				write(3, &exec_errno, 1);
				_exit(-1);
			}
			if (setexeccon(exec_context) == -1) {
				/* Failed to set exec context? */
				exec_errno = 0xfc;
				write(3, &exec_errno, 1);
				_exit(-1);
			}

so it is possible to set proper context transition in the policy. The helper has following file context:

# ls -lZ /usr/libexec/ipa/com.redhat.idm.trust-fetch-domains 
-rwxr-xr-x. 1 root root system_u:object_r:ipa_helper_exec_t:s0 7716 Jul  7 09:17 /usr/libexec/ipa/com.redhat.idm.trust-fetch-domains

Does your scenario work with the latest selinux-policy?

Yes, I believe it works now, at least looking at the testing of AD trust relationship done by IdM QE team.

(In reply to Alexander Bokovoy from comment #12)
> Yes, I believe it works now, at least looking at the testing of AD trust
> relationship done by IdM QE team.

Thank you for testing.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html