https://bugzilla.redhat.com/show_bug.cgi?id=2334087
--- Comment #3 from Alexey Tikhonov atikhono@redhat.com --- Hi,
(In reply to Jan Pazdziora from comment #0)
setcap cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep /usr/libexec/sssd/ldap_child
'cap_chown' is not needed. Replacement of 'cap_dac_read_search=p' with 'cap_dac_override=ep' does the trick for you, but (as you already figured out) the real cause is
(In reply to Jan Pazdziora from comment #2)
I've verified that adding --cap-add=cap_dac_read_search to the $docker run also addresses the problem.
So the issue seems to be that cap_dac_read_search is not among the default set of capabilities that containers get.
In SSSD ci we just allowed everything required explicitly: https://github.com/SSSD/sssd-ci-containers/commit/211908d6357584882118035301...