Description of problem:
ipa server does not allow SELinux user maps with sensitivities larger than s15
and categories larger than c1023. These values are taken and hardcoded from the
default mls SELinux policy.  However, SELinux architecture allows one to set up
systems with sensitivities and categories numbers that are larger than the
default. SELinux policy, kernel and user level code do not assume that only 16
sensitivities and 1024 categories can exist on the system. ipa should not make
that assumption and allow ipa to manage systems with larger number of
sensitivities and categories.  If ipa wants to enforce some kind of valid
number, it should be provided as a configuration parameter. Older, rhel6
versions of ipa did not enforce these sensitivities and categories max count
numbers.
How reproducible:
100%
Steps to Reproduce:
1. Attempt to add an SELinux user map rule where the default context contains
sensitivity higher than s15 and/or category higher than c1023. For example, a
default context of staff_u:staff_r:staff_t:s0-s256:c0.c2048
Additional info:
ne of the biggest advantage of SELinux mls is that it's flexible and configurable. 
It's allowed to increase the number of sensitivities to 256, e.g. for interaction with 
legacy CIPSO systems. Some may also  need to increase the number of categories 
beyond the default 1024. This new validation in ipa prevents ipa to manage systems with
updated sensitivities and/or categories.  Our current workaround is to change
the ipa python plugin which enforces this limit. But that is cumbersome to
maintain and requires us to manual code change every time the ipa rpm is
updated.