This research spike comes out of discussion with Julie Pichon and our SELinux experts (Dan Walsh specifically).

Specific details are in the linked RHBZ [1] but in brief: We need to research the feasibility and plan for the removal of the selinux dac_override. Dan Walsh has created a blog article [2] describing why this may have been put in place and how to work around it.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2000945
[2] https://danwalsh.livejournal.com/79643.html