AVC "dac_override" seen when selinux_child executes

Issue

• The audit log shows a dac_override AVC popping up when selinux_child process executes

  # ausearch -i -ts recent -m avc,user_avc
  [...]
  type=PROCTITLE msg=[...] : proctitle=/usr/libexec/sssd/selinux_child [...]
  type=PATH msg=[...] : item=0 name=/var/lib/selinux/targeted/active/modules [...] dev=fd:05 mode=dir,700 ouid=dtuser ogid=dtuser rdev=00:00 obj=system_u:object_r:semanage_store_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
  type=CWD msg=[...] : cwd=/
  type=SYSCALL msg=[...] : arch=x86_64 syscall=access success=no exit=EACCES(Permission denied) [...] comm=selinux_child exe=/usr/libexec/sssd/selinux_child subj=system_u:system_r:sssd_selinux_manager_t:s0 key=(null)
  type=AVC msg=[...] : avc:  denied  { dac_override } for  pid=[...] comm=selinux_child capability=dac_override  scontext=system_u:system_r:sssd_selinux_manager_t:s0 tcontext=system_u:system_r:sssd_selinux_manager_t:s0 tclass=capability permissive=0