Description of problem:

By default, the "nscd_use_shm" boolean is enabled. When enabling "nscd.service" unit, a customer sees AVCs related to mapping the nscd files into memory:

Examples:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=MMAP msg=audit(1573121827.671:504): fd=9 flags=0x1
type=SYSCALL msg=audit(1573121827.671:504): arch=c000003e syscall=9 success=yes exit=139970810851328 a0=0 a1=34fc8 a2=1 a3=1 items=0 ppid=1458 pid=11370 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=system_u:system_r:postfix_cleanup_t:s0 key=(null)
type=AVC msg=audit(1573121827.671:504): avc:  denied  { map } for  pid=11370 comm="cleanup" path="/var/db/nscd/hosts" dev="dm-3" ino=2113217 scontext=system_u:system_r:postfix_cleanup_t:s0 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=file permissive=1

type=MMAP msg=audit(1573127709.632:479): fd=5 flags=0x1
type=SYSCALL msg=audit(1573127709.632:479): arch=c000003e syscall=9 success=yes exit=140258057723904 a0=0 a1=34fc8 a2=1 a3=1 items=0 ppid=89285 pid=89286 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1573127709.632:479): avc:  denied  { map } for  pid=89286 comm="chronyc" path="/var/db/nscd/hosts" dev="dm-3" ino=2113217 scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=file permissive=1
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

All nscd clients ("nsswitch_domain" domains) are affected, in particular postfix_*_t domains.
Additionally, "chronyc_t" domain is affected: this domain is not part of "nsswitch_domain" attribute and I believe it's missing.

Looking closely, I can see that a rule exists for "nsswitch_domain" on "nscd_var_run_t", but *only* if "nscd_use_shm" is disabled, which looks weird to me:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow nsswitch_domain nscd_var_run_t:file map; [ nscd_use_shm ]:False
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

I would expect "nscd_use_shm" boolean adds more rules, but not toggles rules, since a nscd client may use shm or not (this depends on the configuration in /etc/nscd.conf and is table dependent: you may have a "shared yes" for 1 table but not the other) and the socket seems always used anyway.

Policy shows it's a "If Else" definition "Either SHM, or SOCKET):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
interface(`nscd_use',`
        tunable_policy(`nscd_use_shm',`
                nscd_shm_use($1)
        ',` 
                nscd_socket_use($1)
        ')  
')
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Additionally, I would expect "chronyc_t" to be part of "nsswitch_domain".


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-20.el8.noarch


How reproducible:

Always


Steps to Reproduce:
1. Install chrony and nscd

  # yum -y install chronyc nscd
  # systemctl start nscd
  # systemctl start chronyd

2. Execute chronyc

  # chronyc sources

Actual results:

type=MMAP msg=audit(1573813431.484:214): fd=5 flags=0x1
type=SYSCALL msg=audit(1573813431.484:214): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=34fc8 a2=1 a3=1 items=0 ppid=1715 pid=4860 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="chronyc" exe="/usr/bin/chronyc" subj=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1573813431.484:214): avc:  denied  { map } for  pid=4860 comm="chronyc" path="/var/db/nscd/hosts" dev="dm-0" ino=50333164 scontext=unconfined_u:unconfined_r:chronyc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=file permissive=0


Expected results:

No AVC. Also, if "nscd_use_shm" is disabled, no AVC (the same happens here because chronyc_t is not part of nsswitch_domain).