Description of problem:

pam_cap PAM module is used to limit capabilities to certain users, for example we can add capability "cap_dac_read_search" to /usr/bin/find so that the command can be used by any user to search anywhere, but still want to only let user "testuser" use the functionality.
For this to happen, the following customization can be set in place:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# setcap cap_dac_read_search+ie /usr/bin/find
# echo "cap_dac_read_search testuser" > /etc/security/capability.conf 
# echo "auth        required      pam_cap.so" >> /etc/pam.d/postlogin
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

When using such snippet, we can see that "testuser" login in using ssh or on console cannot get the expected capability, due to the following AVC:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
type=PROCTITLE msg=audit(02/22/2023 13:45:07.997:283) : proctitle=sshd: testuser [priv] 
type=SYSCALL msg=audit(02/22/2023 13:45:07.997:283) : arch=x86_64 syscall=capset success=no exit=EACCES(Permission denied) a0=0x555c63d541d4 a1=0x555c63d541dc a2=0x555c63d541dc a3=0x1 items=0 ppid=901 pid=26970 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=sshd exe=/usr/sbin/sshd subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(02/22/2023 13:45:07.997:283) : avc:  denied  { setcap } for  pid=26970 comm=sshd scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process permissive=0 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This AVC happens while the session handler still executes as "sshd_t" because we are still in PAM.

We need to allow this through adding the following rule:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# echo "(allow login_pgm self (process (setcap)))" > allow_pam_cap.cil
# semodule -i allow_pam_cap.cil
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-108.el8_7.1.noarch

How reproducible:

Always

Steps to Reproduce: see above

Actual results:

AVC

Expected results:

No AVC