Upstream ticket:
https://fedorahosted.org/sssd/ticket/1708

Verified in version 1.9.2-59

Output from beaker automation run:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: bz886038 SSSD should no longer keep connection to sssd.log open
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Stopping sssd: [  OK  ]
Starting sssd: [  OK  ]
[  OK  ]
:: [04:31:56] ::  Sleeping for 5 seconds
:: [   PASS   ] :: sssd_nss doesn't have open connection to sssd.log
:: [   PASS   ] :: sssd_be doesn't have open connection to sssd.log
sssd    12437 root    3w   REG              253,0   193680  526076 /var/log/sssd/sssd.log
:: [   PASS   ] :: sssd has open connection to sssd.log
:: [04:32:02] ::  Rename sssd.log to sssd.log.old
:: [   PASS   ] :: sssd_nss doesn't have open connection to sssd.log
:: [   PASS   ] :: sssd_be doesn't have open connection to sssd.log
:: [   PASS   ] :: sssd doesn't have open connection to sssd.log.old
'3a7f0e34-4147-4dab-8f8a-0dca7cc1bb75'
bz886038-SSSD-should-no-longer-keep-connection-to-sssd-log-open result: PASS

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0508.html

I need to re-open this again, since sssd still doesn't properly close fds from helper processes like krb5_child:

# rpm -q sssd
sssd-1.11.6-30.el6_6.3.x86_64                               

# ls /proc/*/fd -l| grep deleted
l-wx------. 1 root root 64 Jun  3 10:13 18 -> /var/log/sssd/krb5_child.log-20150512 (deleted)

sssd debug_log_file is opened with open_debug_file_ex(..., bool want_cloexec):

[...]

(want_cloexec) {
         flags = fcntl(debug_fd, F_GETFD, 0);
         (void) fcntl(debug_fd, F_SETFD, flags | FD_CLOEXEC);
     }

(from util/debug.c)

This is not the case for LDAP_CHILD_LOG_FILE and KRB5_CHILD_LOG_FILE:

$ grep -iR CHILD_LOG_FILE providers/
providers/krb5/krb5_init_shared.c:        ret = open_debug_file_ex(KRB5_CHILD_LOG_FILE, &debug_filep, false);
providers/ldap/sdap_child_helpers.c:        ret = open_debug_file_ex(LDAP_CHILD_LOG_FILE, &debug_filep, false);