Description of problem:

I'm getting an SELinux violation every time I attempt to log in with an external IdP user account: "SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_override capability."

Version-Release number of selected component (if applicable):
selinux-policy-38.1.11-2.el9_2.3.noarch
sssd-idp-2.8.2-2.el9.x86_64
ipa-server-4.10.1-7.el9_2.x86_64

How reproducible:
always

Steps to Reproduce:
1. Install IPA server on RHEL 9.2
2. Configure an external IdP provider
3. Add user account and configure it for external IdP auth
4. kinit -n -c armor
5. kinit -T armor username

Actual results:

/usr/lib/systemd/system/ipa-otpd@.service:10: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing th>
Created slice Slice /system/ipa-otpd.
Started ipa-otpd service (PID 40758/UID 0).
LDAP: ldapi://%2Frun%2Fslapd-IPAHCC-TEST.socket
cheimes: request received
cheimes: user query start
cheimes: user query end: uid=cheimes,cn=users,cn=accounts,dc=ipahcc,dc=test
cheimes: idp query start: cn=stage sso,cn=idp,dc=ipahcc,dc=test
cheimes: idp query end: stage sso
cheimes: oauth2 start: Get device code
Starting SETroubleshoot daemon for processing new SELinux denial logs...
Started SETroubleshoot daemon for processing new SELinux denial logs.
cheimes: Received: []
  oauth2.c:088: Child finished with status [1].
cheimes: sent: 0 data: 20
cheimes: ..sent: 20 data: 20
cheimes: response sent: Access-Reject
Socket closed, shutting down...
ipa-otpd: Deactivated successfully.
Started dbus-:1.1-org.fedoraproject.SetroubleshootPrivileged.
SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_read_search capability. For complete SELinux messages run: sealert -l f8cb10de-e375-487b-b4ad-ec9a41f7dff3

# sealert -l f8cb10de-e375-487b-b4ad-ec9a41f7dff3
SELinux is preventing /usr/libexec/sssd/oidc_child from using the dac_read_search capability.

*****  Plugin dac_override (91.4 confidence) suggests   **********************

If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
Then turn on full auditing to get path information about the offending file and generate the error again.
Do

Turn on full auditing
# auditctl -w /etc/shadow -p w
Try to recreate AVC. Then execute
# ausearch -m avc -ts recent
If you see PATH record check ownership/permissions on file, and fix it,
otherwise report as a bugzilla.

*****  Plugin catchall (9.59 confidence) suggests   **************************

If you believe that oidc_child should have the dac_read_search capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'oidc_child' --raw | audit2allow -M my-oidcchild
# semodule -X 300 -i my-oidcchild.pp


Additional Information:
Source Context                system_u:system_r:ipa_otpd_t:s0
Target Context                system_u:system_r:ipa_otpd_t:s0
Target Objects                Unknown [ capability ]
Source                        oidc_child
Source Path                   /usr/libexec/sssd/oidc_child
Port                          <Unknown>
Host                          server.   .test
Source RPM Packages           sssd-idp-2.8.2-2.el9.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-38.1.11-2.el9_2.3.noarch
Local Policy RPM              ipa-selinux-4.10.1-7.el9_2.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     server.ipahcc
Platform                      Linux server.ipahcc
                              5.14.0-284.21.1.el9_2.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Jun 22 09:53:03 EDT 2023
                              x86_64 x86_64
Alert Count                   9
First Seen                    2023-07-17 05:15:26 EDT
Last Seen                     2023-07-17 05:18:04 EDT
Local ID                      f8cb10de-e375-487b-b4ad-ec9a41f7dff3

Raw Audit Messages
type=AVC msg=audit(1689585484.18:7276): avc:  denied  { dac_read_search } for  pid=77100 comm="oidc_child" capability=2  scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=1


type=SYSCALL msg=audit(1689585484.18:7276): arch=x86_64 syscall=openat success=yes exit=E2BIG a0=ffffff9c a1=7fc876bb99d1 a2=80000 a3=0 items=0 ppid=77099 pid=77100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=oidc_child exe=/usr/libexec/sssd/oidc_child subj=system_u:system_r:ipa_otpd_t:s0 key=(null)

Hash: oidc_child,ipa_otpd_t,ipa_otpd_t,capability,dac_read_search


# ausearch -c 'oidc_child'
----
time->Mon Jul 17 05:17:33 2023
type=PROCTITLE msg=audit(1689585453.953:7268): proctitle=2F7573722F6C6962657865632F737373642F6F6964635F6368696C64002D2D6765742D6465766963652D636F6465002D2D6465766963652D617574682D656E64706F696E740068747470733A2F2F73736F2E73746167652E7265646861742E636F6D2F617574682F7265616C6D732F7265646861742D65787465726E616C2F70
type=SYSCALL msg=audit(1689585453.953:7268): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7fcce8fb99d1 a2=80000 a3=0 items=0 ppid=77081 pid=77082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oidc_child" exe="/usr/libexec/sssd/oidc_child" subj=system_u:system_r:ipa_otpd_t:s0 key=(null)
type=AVC msg=audit(1689585453.953:7268): avc:  denied  { dac_override } for  pid=77082 comm="oidc_child" capability=1  scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=0
type=AVC msg=audit(1689585453.953:7268): avc:  denied  { dac_read_search } for  pid=77082 comm="oidc_child" capability=2  scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=0
----
time->Mon Jul 17 05:18:04 2023
type=PROCTITLE msg=audit(1689585484.018:7276): proctitle=2F7573722F6C6962657865632F737373642F6F6964635F6368696C64002D2D6765742D6465766963652D636F6465002D2D6465766963652D617574682D656E64706F696E740068747470733A2F2F73736F2E73746167652E7265646861742E636F6D2F617574682F7265616C6D732F7265646861742D65787465726E616C2F70
type=SYSCALL msg=audit(1689585484.018:7276): arch=c000003e syscall=257 success=yes exit=7 a0=ffffff9c a1=7fc876bb99d1 a2=80000 a3=0 items=0 ppid=77099 pid=77100 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oidc_child" exe="/usr/libexec/sssd/oidc_child" subj=system_u:system_r:ipa_otpd_t:s0 key=(null)
type=AVC msg=audit(1689585484.018:7276): avc:  denied  { dac_read_search } for  pid=77100 comm="oidc_child" capability=2  scontext=system_u:system_r:ipa_otpd_t:s0 tcontext=system_u:system_r:ipa_otpd_t:s0 tclass=capability permissive=1


Expected results:


Additional info: