In order to allow qemu to authenticate SPICE connections with SASL GSSAPI when SSSD is in use, one needs to make sure svirt_t processes are allowed to read files in /var/lib/sss/pubconf/krb5.conf.d/.

Right now only ability to read the directory in question is allowed:
[pid  4018] open("/var/lib/sss/pubconf/krb5.include.d/", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 32
[pid  4018] open("/var/lib/sss/pubconf/krb5.include.d//domain_realm_example_com", O_RDONLY) = -1 EACCES (Permission denied)

# sesearch -A -s svirt_t|grep sssd
allow svirt_t sssd_public_t:dir read;

We need also rules to allow reading files:

# echo "(allow svirt_t sssd_public_t (file (read getattr open)))" > my-local-rule.cil && semodule -i my-local-rule.cil

After adding this temporary rule svirt_t process can complete initializing libkrb5 and offer SASL GSSAPI to its clients.