libkrb5 by default use a rcache named /var/tmp/_ this may cause issues with SELinux policies and sometimes causes issues if root tests some things with a keytab and then leaves the wrong label on the file.

Plus in general we assume that when you give a keytab to GSS-Proxy you do not share it with any other program but make all programs go through GSS-Proxy for privilege separation. The rcache should be also managed within GSS-Proxy in a consistent manner in this case and not be accessible to external applications.

This can be achieve by adding a default cred_store option set to something like: rcache:dfl:/var/lib/gssproxy/rcaches/svc-principal-name
if no explicit rcache is set by the admin in the config.

This will assure all uses of the same key (same principal name hopefully with no aliases) will use the same rcache.

All these assumptions MUST be explained in the gssproxy man page as part of resolving this ticket as they are critical for the admin to make an informed decision about the configuration options to use.