The retrieving data from sssd as root works
-bash-4.2# systemctl start sssd

-bash-4.2# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
497c49b57eb8        rhel7/sssd          "/bin/run.sh"       3 minutes ago       Up 8 seconds                            sssd

-bash-4.2# id Administrator 
uid=1827400500(administrator) gid=1827400513(domain users) groups=1827400513(domain users),1827400518(schema admins),1827400512(domain admins),1827400520(group policy creator owners),1827400519(enterprise admins),1827400572(denied rodc password replication group)


But other services (sshd) cannot due to AVCs
-bash-4.2# ssh -l Administrator localhost
Administrator@localhost's password: 
Permission denied, please try again.
Administrator@localhost's password: 

-bash-4.2# dmesg | tail
[ 4135.804800] type=1400 audit(1476781785.109:11): avc:  denied  { connectto } for  pid=18731 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4135.807039] type=1400 audit(1476781785.111:12): avc:  denied  { connectto } for  pid=18731 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4199.591077] XFS (dm-4): Unmounting Filesystem
[ 4273.082839] XFS (dm-4): Mounting V4 Filesystem
[ 4273.090218] XFS (dm-4): Ending clean mount
[ 4324.828861] type=1400 audit(1476781974.133:14): avc:  denied  { connectto } for  pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4329.784784] type=1400 audit(1476781979.089:15): avc:  denied  { connectto } for  pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4329.792861] type=1400 audit(1476781979.097:16): avc:  denied  { connectto } for  pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket
[ 4329.797139] type=1400 audit(1476781979.102:17): avc:  denied  { connectto } for  pid=18934 comm="sshd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:docker_t:s0 tclass=unix_stream_socket

Moving to rhel-server-docker because privileged container based on base image does not run as spc_t.

But it's possible that the bug is not in base image but in selinux-policy or docker-selinux. Feel free to reassign

-bash-4.2# atomic host status 
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
       Version: 7.3 (2016-10-06 18:32:58)
        Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757
        OSName: rhel-atomic-host

-bash-4.2# rpm -qa | grep selinux
libselinux-utils-2.5-6.el7.x86_64
selinux-policy-targeted-3.13.1-102.el7.noarch
libselinux-2.5-6.el7.x86_64
docker-selinux-1.10.3-55.el7.x86_64
selinux-policy-3.13.1-102.el7.noarch
libselinux-python-2.5-6.el7.x86_64

BTW authentication works well in permissive mode.

-bash-4.2# setenforce 1
-bash-4.2# ssh -l Administrator localhost
Administrator@localhost's password: 
Permission denied, please try again.
Administrator@localhost's password: 

-bash-4.2# setenforce 0
-bash-4.2# ssh -l Administrator localhost
Administrator@localhost's password: 
Last failed login: Tue Oct 18 09:32:20 UTC 2016 from localhost on ssh:notty
There were 2 failed login attempts since the last successful login.
Last login: Tue Oct 18 09:31:29 2016 from localhost
Could not chdir to home directory /home/administrator: No such file or directory
-bash-4.2$ logout
Connection to localhost closed.
-bash-4.2#

This looks like docker-selinux did not get installed correctly?

dnf reinstall docker-selinux

(In reply to Daniel Walsh from comment #7)
> This looks like docker-selinux did not get installed correctly?
> 
How is it possible in ostree? @see comment 5

> dnf reinstall docker-selinux

dnf is not not atomic host.

(In reply to Lukas Slebodnik from comment #8)
> (In reply to Daniel Walsh from comment #7)
> > This looks like docker-selinux did not get installed correctly?
> > 
> How is it possible in ostree? @see comment 5
> 
> > dnf reinstall docker-selinux
> 
ehm

dnf is not on rhel atomic host 7.3

Of this is happening on Atomic Host, then I would guess something went wrong on the server build.

ps -eZ | grep docker

Make sure these are running with the correct label.

rpm -q container-selinux

-bash-4.2# atomic host status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
       Version: 7.3 (2016-10-06 18:32:58)
        Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757
        OSName: rhel-atomic-host
  GPGSignature: (unsigned)

  rhel7-atomic:rhel-atomic-host/7/x86_64/standard
       Version: 7.2.7 (2016-09-09 18:43:35)
        Commit: 347c3f5eb641e69fc602878c646cf42c4bcd5d9f36847a1f24ff8f3ec80f17b1
        OSName: rhel-atomic-host

-bash-4.2# ps -eZ | grep docker
system_u:system_r:docker_t:s0    12136 ?        00:00:00 docker-current

-bash-4.2# rpm -qa "*selinux*"
libselinux-utils-2.5-6.el7.x86_64
selinux-policy-targeted-3.13.1-102.el7.noarch
libselinux-2.5-6.el7.x86_64
docker-selinux-1.10.3-55.el7.x86_64
selinux-policy-3.13.1-102.el7.noarch
libselinux-python-2.5-6.el7.x86_64

-bash-4.2# rpm -q docker
docker-1.10.3-55.el7.x86_64

What is the output of?

docker run fedora cat /proc/self/attr/current
docker run --privileged fedora  cat /proc/self/attr/current

-bash-4.2# docker run --rm fedora:24 cat /proc/self/attr/current
system_u:system_r:svirt_lxc_net_t:s0:c369,c616
-bash-4.2# 
-bash-4.2# 
-bash-4.2# docker run --rm --privileged fedora:24 cat /proc/self/attr/current
system_u:system_r:docker_t:s0
-bash-4.2#

That is wrong.

Does

restorecon -R -v /var/lib/docker

Change labels?

-bash-4.2# restorecon -R -v /var/lib/docker
restorecon reset /var/lib/docker/containers/62be8d908dbc1531889e4f9fddaecb2be670a8ef9723ac7f8adfd1d9dde5f335/hosts context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0
restorecon reset /var/lib/docker/containers/62be8d908dbc1531889e4f9fddaecb2be670a8ef9723ac7f8adfd1d9dde5f335/hostname context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0
restorecon reset /var/lib/docker/containers/6192c9e5b08be21af3856a4a89be924898803eb42ffd1d4c421f00dc3d11064d/hosts context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0
restorecon reset /var/lib/docker/containers/6192c9e5b08be21af3856a4a89be924898803eb42ffd1d4c421f00dc3d11064d/hostname context system_u:object_r:docker_var_lib_t:s0->system_u:object_r:docker_share_t:s0

-bash-4.2# docker run --rm fedora:24 cat /proc/self/attr/current
system_u:system_r:svirt_lxc_net_t:s0:c535,c769
-bash-4.2# 
-bash-4.2# docker run --rm --privileged fedora:24 cat /proc/self/attr/current
system_u:system_r:docker_t:s0
-bash-4.2#

Do I use right rhel AH 7.3 ostree?

-bash-4.2# rpm-ostree status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
       Version: 7.3 (2016-10-06 18:32:58)
        Commit: bd5ac48f6195637c0230d9b0ab0a2e5fb843764f85bc64757106238bdf31e757
        OSName: rhel-atomic-host

Explicit usage of spc_t did not help either

-bash-4.2# docker run --rm --privileged --security-opt=label:type:spc_t fedora:24 cat /proc/self/attr/current
system_u:system_r:docker_t:s0
-bash-4.2#

For rhel7.3.0 we need to add these two rules to the docker.te file before we ship.

kernel_unlabeled_domtrans(docker_t, spc_t)
kernel_unlabeled_entry_type(spc_t)

Currently privileged containers are not running as spc_t, they are running as docker_t, these rules will fix the issue. We need this added until we get to docker-1.12 I believe. I think it would be easiest to just add a patch in the spec file to handle this.  Rather then playing with github.

This is a blocker issue, as it will break layered products like the sssd container.

On RHEL 7.3 w/ a docker 1.10.3-57 build, I get:

[root@ ~]# docker run --rm fedora:24 cat /proc/self/attr/current
system_u:system_r:svirt_lxc_net_t:s0:c718,c1015
[root@ ~]# 
[root@ ~]# docker run --rm --privileged fedora:24 cat /proc/self/attr/current
system_u:system_r:spc_t:s0
[root@ ~]#

Excellent.

Docker version: docker-1.10.3-57.el7.x86_64
IPA server version: ipa-server-4.4.0-12.el7.x86_64
IPA client inside sssd-container: ipa-client-4.4.0-12.el7.x86_64
IPA server inside sssd-container: ipa-server is not installed

Tested the bug with following observations and the issue mentioned w.r.t IPA in Comment#12 is no more observed:

-bash-4.2# atomic install rhel7/sssd
docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh
Initializing configuration context from host ...
Client hostname: rhel73atomic.testrelm.test
Realm: TESTRELM.TEST
DNS Domain: testrelm.test
IPA Server: vm37.testrelm.test
BaseDN: dc=testrelm,dc=test
Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=TESTRELM.TEST
    Issuer:      CN=Certificate Authority,O=TESTRELM.TEST
    Valid From:  Tue Oct 25 11:38:16 2016 UTC
    Valid Until: Sat Oct 25 11:38:16 2036 UTC

Enrolled in IPA realm TESTRELM.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.TEST
trying https://vm37.testrelm.test/ipa/json
Forwarding 'schema' to json server 'https://vm37.testrelm.test/ipa/json'
trying https://vm37.testrelm.test/ipa/json
Forwarding 'ping' to json server 'https://vm37.testrelm.test/ipa/json'
Forwarding 'ca_is_enabled' to json server 'https://vm37.testrelm.test/ipa/json'
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Forwarding 'host_mod' to json server 'https://vm37.testrelm.test/ipa/json'
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring testrelm.test as NIS domain.
Client configuration complete.

Copying new configuration to host ...
Full path required for exclude: net:[4026531956].
Service sssd.service configured to run SSSD container.

-bash-4.2# systemctl restart sssd

-bash-4.2# systemctl status sssd
● sssd.service - System Security Services Daemon in container
   Loaded: loaded (/etc/systemd/system/sssd.service; disabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/sssd.service.d
           └─journal.conf
   Active: active (exited) since Wed 2016-10-26 05:54:46 EDT; 5s ago
  Process: 13815 ExecStart=/usr/bin/atomic run --name=sssd rhel7/sssd (code=exited, status=0/SUCCESS)
 Main PID: 13815 (code=exited, status=0/SUCCESS)

Oct 26 05:54:43 rhel73atomic.testrelm.test systemd[1]: Starting System Security Services Daemon in container...
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: docker run -d --restart=always --privileged --net=host...etc/
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: This container uses privileged security switches:
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: INFO: --net=host
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: Processes in this container can listen to ports (and p...ork.
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: INFO: --privileged
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: This container runs without separation and should be c...tem.
Oct 26 05:54:45 rhel73atomic.testrelm.test atomic[13815]: fae74c772224f70c39ffe2510aa2766cc0c010d8099bb312ad9bf7...a873
Oct 26 05:54:46 rhel73atomic.testrelm.test atomic[13815]: For more information on these switches and their secur...un'.
Oct 26 05:54:46 rhel73atomic.testrelm.test systemd[1]: Started System Security Services Daemon in container.
Hint: Some lines were ellipsized, use -l to show in full.


-bash-4.2# docker exec -i sssd kinit admin
Password for admin: ******

-bash-4.2# docker exec -i sssd klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin

Valid starting     Expires            Service principal
10/26/16 05:55:22  10/27/16 05:55:19  krbtgt/TESTRELM.TEST

-bash-4.2# docker exec -i sssd kdestroy

-bash-4.2# docker exec -i sssd klist
klist: Credentials cache keyring 'persistent:0:0' not found

-bash-4.2# docker exec -i sssd kinit admin
Password for admin: ******

-bash-4.2# docker exec -i sssd klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin

Valid starting     Expires            Service principal
10/26/16 05:55:47  10/27/16 05:55:44  krbtgt/TESTRELM.TEST

-bash-4.2# ssh -o GSSAPIAuthentication=yes admin.test
Last login: Wed Oct 26 05:32:59 2016 from rhel73atomic.testrelm.test
Could not chdir to home directory /home/admin: No such file or directory
-bash-4.2$ whoami
admin

-bash-4.2$ exit
logout
Connection to rhel73atomic.testrelm.test closed.

-bash-4.2# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

-bash-4.2# systemctl stop sssd
-bash-4.2# systemctl status sssd
● sssd.service - System Security Services Daemon in container
   Loaded: loaded (/etc/systemd/system/sssd.service; disabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/sssd.service.d
           └─journal.conf
   Active: inactive (dead)

Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: Processes in this container can listen to ports (and p...ork.
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: INFO: --privileged
Oct 26 05:54:44 rhel73atomic.testrelm.test atomic[13815]: This container runs without separation and should be c...tem.
Oct 26 05:54:45 rhel73atomic.testrelm.test atomic[13815]: fae74c772224f70c39ffe2510aa2766cc0c010d8099bb312ad9bf7...a873
Oct 26 05:54:46 rhel73atomic.testrelm.test atomic[13815]: For more information on these switches and their secur...un'.
Oct 26 05:54:46 rhel73atomic.testrelm.test systemd[1]: Started System Security Services Daemon in container.
Oct 26 06:08:17 rhel73atomic.testrelm.test systemd[1]: Stopping System Security Services Daemon in container...
Oct 26 06:08:18 rhel73atomic.testrelm.test atomic[14044]: sssd
Oct 26 06:08:18 rhel73atomic.testrelm.test atomic[14044]: docker kill -s TERM sssd
Oct 26 06:08:18 rhel73atomic.testrelm.test systemd[1]: Stopped System Security Services Daemon in container.
Hint: Some lines were ellipsized, use -l to show in full.

-bash-4.2# atomic uninstall rhel7/sssd
docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/uninstall.sh
Initializing configuration context from host ...
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Client uninstall complete.
Copying new configuration to host ...
Removing /etc/ipa/nssdb/pwdfile.txt
Removing /etc/ipa/nssdb/secmod.db
Removing /etc/ipa/nssdb/cert8.db
Removing /etc/ipa/nssdb/key3.db
Removing /etc/ipa/ca.crt
Removing /etc/ipa/default.conf
Removing /etc/sssd/systemctl-lite-enabled/sssd.service
Removing /etc/sssd/systemctl-lite-enabled/rhel-domainname.service
Removing /etc/sssd/sssd.conf
Removing /var/lib/ipa-client/sysrestore/ecbbfbe9acaf4214-nsswitch.conf
Removing /var/lib/ipa-client/sysrestore/sysrestore.index
Removing /var/lib/ipa-client/sysrestore/5daa1cc1c5db890f-krb5.conf
Removing /var/lib/ipa-client/sysrestore/sysrestore.state
Removing /var/lib/ipa-client/sysrestore/32619519e6946e4d-ldap.conf
Removing /var/lib/ipa-client/sysrestore/4d52da414ab5cf48-ssh_config
Removing /var/lib/ipa-client/sysrestore/eb936dcc8626f8e0-sshd_config
Removing /var/lib/sss/pipes/private/sbus-dp_testrelm.test.125
Removing /var/lib/sss/pipes/private/sbus-monitor
Removing /var/lib/sss/pipes/private/sbus-dp_testrelm.test.14
Removing /var/lib/sss/pipes/private/sbus-dp_testrelm.test
Removing /var/lib/sss/pipes/private/pam
Removing /var/lib/sss/db/cache_testrelm.test.ldb
Removing /var/lib/sss/db/ccache_TESTRELM.TEST
Removing /var/lib/sss/mc/passwd
Removing /var/lib/sss/mc/group

Versions:
========
[root@atomic-1 sssd]# atomic host status
State: idle
Deployments:
● rhel-atomic-host:rhel-atomic-host/7/x86_64/standard
       Version: 7.3 (2016-10-26 14:24:09)
        Commit: 90c9735becfff1c55c8586ae0f2c904bc0928f042cd4d016e9e0e2edd16e5e97
        OSName: rhel-atomic-host


[root@atomic-1 sssd]# docker images
REPOSITORY             TAG                                               IMAGE ID            CREATED             SIZE
lslebodn/sssd-docker   extras-rhel-7.3-docker-candidate-20161028173817   76f8fba288aa        4 days ago          357.3 MB
rhel7/sssd             latest                                            76f8fba288aa        4 days ago          357.3 MB

Docker Version:
==============
docker-1.10.3-57.el7.x86_64

1. Join atomic host to Windows AD 2012R2

[root@atomic-1 sssd]# atomic install rhel7/sssd realm join CENTAUR.TEST -v
docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh realm join CENTAUR.TEST -v
Initializing configuration context from host ...
 * Resolving: _ldap._tcp.centaur.test
 * Performing LDAP DSE lookup on: 192.168.122.187
 * Successfully discovered: CENTAUR.TEST
Password for Administrator:  * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.ZWGIQY -U Administrator ads join CENTAUR.TEST
Enter Administrator's password:DNS update failed: NT_STATUS_INVALID_PARAMETER

Using short domain name -- CENTAUR
Joined 'ATOMIC-1' to dns domain 'CENTAUR.TEST'
No DNS domain configured for atomic-1. Unable to perform DNS Update.
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.ZWGIQY -U Administrator ads keytab create
Enter Administrator's password:
 * /usr/bin/systemctl enable sssd.service
 * /usr/bin/systemctl restart sssd.service
 * /usr/bin/sh -c /usr/sbin/authconfig --update --enablesssd --enablesssdauth --enablemkhomedir --nostart && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service

 * Successfully enrolled machine in realm
Copying new configuration to host ...
Full path required for exclude: net:[4026531956].
Service sssd.service configured to run SSSD container.



2.Restart sssd process
[root@atomic-1 sssd]# ps -efZ | grep sssd
system_u:system_r:spc_t:s0      root      12750  12738  0 06:40 ?        00:00:00 tail -f /var/log/sssd/systemctl.log
system_u:system_r:spc_t:s0      root      12755  12738  0 06:40 ?        00:00:00 /usr/sbin/sssd -D -f
system_u:system_r:spc_t:s0      root      12756  12755  0 06:40 ?        00:00:00 /usr/libexec/sssd/sssd_be --domain CENTAUR.TEST --uid 0 --gid 0 --debug-to-files
system_u:system_r:spc_t:s0      root      12758  12755  0 06:40 ?        00:00:00 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --debug-to-files
system_u:system_r:spc_t:s0      root      12759  12755  0 06:40 ?        00:00:00 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --debug-to-files
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 12802 12260  0 06:42 pts/0 00:00:00 grep --color=auto sssd


3.Id and login as AD user successfull

[root@atomic-1 sssd]# id Administrator
uid=1993600500(administrator) gid=1993600513(domain users) groups=1993600513(domain users),1993600520(group policy creator owners),1993600519(enterprise admins),1993600572(denied rodc password replication group),1993601671(testgroup1),1993600512(domain admins),1993600518(schema admins),1993601669(myunixgroup)
[root@atomic-1 sssd]# ssh Administrator@localhost
The authenticity of host 'localhost (::1)' can't be established.
ECDSA key fingerprint is 10:f8:fb:28:d7:5f:46:f4:27:1f:61:56:a9:e3:d2:4a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
Administrator@localhost's password: 
Could not chdir to home directory /home/administrator: No such file or directory
-bash-4.2$ logout
Connection to localhost closed.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2634.html