Is this connected to the case we discussed yesterday with the homedir permissions?

Because from the description only, I don't see why this is an issue, it's an optimization. As you can see, __default__ is unconfined_u and if the 7.5 version doesn't set unconfined_u explicitly, the default will apply.

btw does this issue happen also if you set the SELinux mapping to something else than unconfined? In other words, is this an issue with setting the context or just not setting the default context.

Yes it is connected.

The issue with this "optimization" is that users which are mapped to default "unconfined_u" are not mapped anymore.
This breaks if homedir for user is *not* the standard one, i.e.:
- /home/<user>
or
- /home/<domain>/<user> and no equivalency context has been put in place for /home/<domain>
or
- some other dir e.g. /opt/home/<user> which is defined in backend's user entry and no equivalency context has been put in place manually

Yes, I just confirmed that with Petr Lautrbach. We need to fix this in SSSD, I guess.

Removing the optimization would be easy, but then every login would incur a substantial IO hit, because setting the context is quite costly. We've already had users disabling the selinux provider just to get better performance, even with this optimization.

I guess the mapping needs to be done only if user's home dir will not have appropriate context.
This check needs probably to be done through some new libsemanage API ...

I think I have a local patch that fixes the issue. Is it possible if either of you test a package I provide?

Created attachment 1480598 [details]
test_selinux

Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3819

Builds used for verification:
[root@kvm-01-guest03 ~]# rpm -qa sssd ipa-server
ipa-server-4.6.5-8.el7.x86_64
sssd-1.16.4-13.el7.x86_64

Steps:
1. ipa user-add testuser2 --first  test2 --last user --password
2. ssh testuser2.test
3. semanage login -l

Actual Results:
[root@kvm-01-guest03 ~]# ipa user-add testuser2 --first  test2 --last user --password
Password: 
Enter Password again to verify: 
----------------------
Added user "testuser2"
----------------------
  User login: testuser2
  First name: test2
  Last name: user
  Full name: test2 user
  Display name: test2 user
  Initials: tu
  Home directory: /home/testuser2
  GECOS: test2 user
  Login shell: /bin/sh
  Principal name: testuser2
  Principal alias: testuser2
  User password expiration: 20190516064618Z
  Email address: testuser2
  UID: 628800004
  GID: 628800004
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True
[root@kvm-01-guest03 ~]# hostname
kvm-01-guest03.testrelm.test
[root@kvm-01-guest03 ~]# ssh testuser2.test
Password: 
Password expired. Change your password now.
Current Password: 
Password change failed. Server message: Old password not accepted.

Password: 
Password expired. Change your password now.
Current Password: 
New password: 
Retype new password: 
Last failed login: Thu May 16 09:47:10 IDT 2019 from kvm-01-guest03.testrelm.test on ssh:notty
There was 1 failed login attempt since the last successful login.
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by ssidhaye.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/6867964

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/kvm-01-guest03.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=kvm-01-guest03.testrelm.test
                            JOBID=3538096
                         RECIPEID=6867964
                    RESULT_SERVER=[::1]:7095
                           DISTRO=RHEL-7.7-20190514.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: 7.7-candidate ssidhaye BZ verification

      Recipe Whiteboard: M
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
Could not chdir to home directory /home/testuser2: No such file or directory
-sh-4.2$ logout
Connection to kvm-01-guest03.testrelm.test closed.
[root@kvm-01-guest03 ~]# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *
test201              unconfined_u         s0-s0:c0.c1023       *
testuser             unconfined_u         s0-s0:c0.c1023       *
testuser2            unconfined_u         s0-s0:c0.c1023       *


Based on above observations marking the bugzilla verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2177