AVCs seen for fapolicyd when users or groups are stored in Active Directory

Issue

• The following AVCs are seen in the audit log when fapolicyd has rules matching users or groups and the users or groups are resolved through winbind NSS backend

  # grep ^passwd /etc/nsswitch.conf 
  passwd:     files winbind systemd
  
  # ausearch -m avc -ts recent -x fapolicyd | grep avc
  [...]
  avc:  denied  { getattr } for  pid=... comm="fapolicyd" path="/run/samba/winbindd/pipe" dev="tmpfs" ino=... scontext=system_u:system_r:fapolicyd_t:s0 tcontext=system_u:object_r:winbind_var_run_t:s0 tclass=sock_file
  avc:  denied  { connectto } for  pid=... comm="fapolicyd" path="/run/samba/winbindd/pipe" scontext=system_u:system_r:fapolicyd_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=unix_stream_socket
  avc:  denied  { write } for  pid=... comm="fapolicyd" name="pipe" dev="tmpfs" ino=... scontext=system_u:system_r:fapolicyd_t:s0 tcontext=system_u:object_r:winbind_var_run_t:s0 tclass=sock_file
  [...]