Description of problem:
After the installation of krb5 I added a new user into a krb5 db via the following command "kadmin -p root/admin -w password -q 'ank -pw password alice". The command finished successfully and the reply cache file was created. The problem is that this file had security context: system_u:object_r:kadmind_tmp_t:s0. This is a problem when the ssh via krb5-GSSAPI is used because sshd service cannot write into this file.  

Version-Release number of selected component (if applicable):
krb5-1.18-1.fc32.x86_64

How reproducible:
always

Steps to Reproduce:
1. Install and configure krb5kdc and kadmin

hostnamectl set-hostname kerberos.example.com
sed -i "1i 127.0.0.1 kerberos.example.com" /etc/hosts
echo -ne '[realms]\nEXAMPLE.COM = {\n    kdc = kerberos.example.com\n    admin_server = kerberos.example.com\n}\n\n[domain_realm]\n.example.com = EXAMPLE.COM\nexample.com = example.com\n' > /etc/krb5.conf.d/example_com
sed -i "s/^# default_realm/ default_realm/" /etc/krb5.conf
echo -ne "passwd\npasswd\n" | kdb5_util create -s
systemctl start krb5kdc kadmin
 
2.kadmin.local -r EXAMPLE.COM -q "addprinc -pw passwd root/admin"
3.kadmin -p root/admin -w password -q 'ank -pw password alice'

Actual results:
# kinit alice
Password for alice: 

ssh alice.com pwd
alice.com's password: 


Expected results:
# kinit alice
Password for alice: 

# ssh alice.com pwd
/home/alice


Additional info:
#ll -Z /var/tmp/krb5_0.rcache2 
-rw-------. 1 root root system_u:object_r:kadmind_tmp_t:s0 3328 May 20 07:22 /var/tmp/krb5_0.rcache2

AVC message:
time->Wed May 20 06:50:45 2020
type=AVC msg=audit(1589971845.880:557): avc:  denied  { write } for  pid=16961 comm="sshd" name="krb5_0.rcache2" dev="vda1" ino=831 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kadmind_tmp_t:s0 tclass=file permissive=0