In case SSSD is compiled --with-sssd-user but run as root (which is the default on RHEL and derivatives), then the memory cache will be owned by the user that sssd_nss runs as, so root.

This conflicts with the packaging which specifies sssd.sssd as the owner. And in turn, this means that users can't reliably assess the package integrity using rpm -V.

We can't just switch the file ownership as this would just revert the problem. But we can chown the memory cache files to sssd.sssd on runtime, provided that the nss process would be a member of the sssd group and the memory cache files were writable by the group.