The gssproxy daemon act as a GSSAPI proxy for user applications.
It is composed of 2 main components: a daemon, and a share library
the shared libarray is loaded automatically by gssapi in to user applications and needs access to sockets created by gssproxy

The default socket is in /var/lib/gssproxy/default.socket and needs to be accessible by any application on the system that uses libgssapi

The gssproxy itself also nees to be able to access any kerberos ccache on the system.

Content under /var/lib/gssproxy/clients should be confined to access eclusively by the gssproxy daemon.