SELinux policy prevents sssd from reading its config file

In Fedora 43, despite the sssd.service systemd config setting many permissions on the /etc/sssd directory and its content, sssd will always fail to read its config file with a permission denied error when started with Fedora 43. The only way I found to get around this was to globally disable selinux in /etc/selinux/config. After that, sssd will start normally.

Likely the conf file has a wrong context. What does

ls -lZ /etc/sssd/sssd.conf

show?

Correct would be:

system_u:object_r:sssd_conf_t:s0

If it’s not, fix it by running:

sudo restorecon -v /etc/sssd/sssd.conf
1 Like