Description of problem:
When using sssd's files provider, but storing the files in the same location that nss-altfiles uses (/usr/lib) sssd needs the ability to set an inotify watch on /usr/lib

Version-Release number of selected component (if applicable):
selinux-policy-37.19-1.fc37.noarch

How reproducible:
100%

Steps to Reproduce:
1. deploy passwd/group for use with nss-altfiles
2. configure sssd to use the same files from nss-altfiles
3. start sssd
4. selinux denial

Actual results:
grep  avc /var/log/audit/audit.log |grep sssd_be | audit2why
type=AVC msg=audit(1678211275.874:251916): avc:  denied  { watch } for  pid=982783 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211275.891:251917): avc:  denied  { watch } for  pid=982784 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211277.914:251925): avc:  denied  { watch } for  pid=982788 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211281.935:251933): avc:  denied  { watch } for  pid=982819 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211374.648:251959): avc:  denied  { watch } for  pid=983290 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211374.666:251960): avc:  denied  { watch } for  pid=983291 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211376.689:251968): avc:  denied  { watch } for  pid=983292 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211380.709:251976): avc:  denied  { watch } for  pid=983321 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1678211392.851:252005): avc:  denied  { watch } for  pid=983334 comm="sssd_be" path="/usr/lib" dev="dm-0" ino=33554564 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=1

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.


Expected results:

Permit watch on system_u:object_r:lib_t:s0

Additional info:

SSSD folks suggest using nss-altfiles as a proxy source. For folks looking to test this and perform a phased migration this policy tweak seems necessary.