https://bugzilla.redhat.com/show_bug.cgi?id=2299722
--- Comment #2 from Sumit Bose sbose@redhat.com --- Hi,
so it looks like the KEYRING type Kerberos credential cache is stored in the kernel keyring with the SELinux label of the application which created/modified/accessed(?) it the last time instead of the generic system_u:system_r:kernel_t:s0 label which would allow access to SSSD and other kerberized application trying to access the credential cache. Maybe it would help to update the title of this ticket accordingly, if you prefer I can do it?
bye, Sumit