https://bugzilla.redhat.com/show_bug.cgi?id=2320133
--- Comment #1 from Alexander Bokovoy abokovoy@redhat.com --- A workaround at this point is to switch off selinux_provider in IPA domain definition in sssd configuration:
[domain/example.test] ... selinux_provider = none
This workaround requires being able to login as root.
Since the whole system image is immutable, an alternative could be to make it mutable and set required capabilities manually. The latter will then be lost on next automated image rebase, sadly.