Description of problem:
Observed AVC denials during the recent rhel-6.10 regression runs of ad_parameter test suite. The "adcli" process was denied execution of file "/usr/bin/net" on a file system hosted on the "dm-0" device. This file has inode number "949886" and has the security context "system_u:object_r:samba_net_exec_t:s0" assigned to it. The "adcli" process is running with security context "unconfined_u:system_r:sssd_t:s0".

ERROR:
 - type=SYSCALL msg=audit(1521532221.642:731): arch=c000003e syscall=21 success=no exit=-13 a0=111e450 a1=1 a2=0 a3=3637373838333337 items=0 ppid=4695 pid=14877 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm="adcli" exe="/usr/sbin/adcli" subj=unconfined_u:system_r:sssd_t:s0 key=(null)

 - type=AVC msg=audit(1521532231.099:732): avc:  denied  { execute } for  pid=14969 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file

I reproduced this error by:
 - Adding "ad_machine_account_password_renewal_opts = 10:30" to the domain section of SSSD.conf file. 
 - Restart SSSD service and monitor /var/log/audit/audit.log file.

Version-Release number of selected component (if applicable):
sssd-1.13.3-60.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Configure sssd.conf as given below:

[sssd]
config_file_version = 2
services = nss, pam
domains = sssdad.com
user = 

[nss]
filter_groups = root
filter_users = root
default_shell = /bin/bash
override_homedir = /home/%u

[domain/sssdad.com]
debug_level = 0xFFF0
id_provider = ad
ad_domain = sssdad.com
krb5_realm = SSSDAD
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
ldap_schema = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
ad_machine_account_password_renewal_opts = 10:30

2. Clear the cache and restart sssd service.

3. Monitor /var/log/audit/audit.log for AVC denial errors.

Actual results:
Beaker job during regression run fails due to AVC denials.
x86_64 : https://beaker.engineering.redhat.com/jobs/2368015
x86_64 : https://beaker.engineering.redhat.com/jobs/2376288

Expected results:
Successful regression round without AVC denials.


Additional info:

Following is the analysis of "sealert" utility :
SELinux is preventing /usr/sbin/adcli from execute access on the file /usr/bin/net.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that adcli should be allowed execute access on the net file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep adcli /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                unconfined_u:system_r:sssd_t:s0
Target Context                system_u:object_r:samba_net_exec_t:s0
Target Objects                /usr/bin/net [ file ]
Source                        adcli
Source Path                   /usr/sbin/adcli
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           samba-common-3.6.23-50.el6.x86_64
Policy RPM                    selinux-policy-3.7.19-312.el6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     vm-idm-034.sssdad.com
Platform                      Linux vm-idm-034.sssdad.com 2.6.32-742.el6.x86_64
                              #1 SMP Fri Mar 2 22:40:54 EST 2018 x86_64 x86_64
Alert Count                   2
First Seen                    Tue Mar 20 13:20:41 2018
Last Seen                     Tue Mar 20 13:20:41 2018
Local ID                      9cb5ee0d-74e1-4e00-af3d-b06c8a98a5ae

Raw Audit Messages
type=AVC msg=audit(1521532241.20:735): avc:  denied  { execute } for  pid=15061 comm="adcli" name="net" dev=dm-0 ino=949886 scontext=unconfined_u:system_r:sssd_t:s0 tcontext=system_u:object_r:samba_net_exec_t:s0 tclass=file