Bug 429893

Description of problem:
I have created an auto.cifs file to allow CIFS automounting with credentials. 
This has caused some AVC alerts.

Version-Release number of selected component (if applicable):
selinux-policy-3.2.5-15.fc9

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Here is the sealert message:

Summary:

SELinux is preventing smbclient(/usr/bin/smbclient) (automount_t) "create" to
<Unknown>
(samba_var_t).

Detailed Description:

SELinux denied access requested by smbclient(/usr/bin/smbclient). It is not
expected that this access is required by smbclient(/usr/bin/smbclient) and this
access may signal an intrusion attempt. It is also possible that the specific
version or configuration of the application is causing it to require additional
access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for <Unknown>,

restorecon -v <Unknown>

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                unconfined_u:system_r:automount_t:s0
Target Context                unconfined_u:object_r:samba_var_t:s0
Target Objects                None [ file ]
Source                        smbclient(/usr/bin/smbclient)
Port                          <Unknown>
Host                          shuttle.config
Source RPM Packages 
Target RPM Packages 
Policy RPM                    selinux-policy-3.2.5-15.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     shuttle.config
Platform                      Linux shuttle.config 2.6.24-0.164.rc8.git4.fc9 #1
                              SMP Mon Jan 21 20:48:16 EST 2008 i686 athlon
Alert Count                   6
First Seen                    Wed Jan 23 17:00:05 2008
Last Seen                     Wed Jan 23 17:00:05 2008
Local ID                      e1c4c55d-54da-459e-b996-cd61afc7a5ce
Line Numbers

Raw Audit Messages  

host=shuttle.config type=AVC msg=audit(1201107605.256:131): avc:  denied  {
create } for  pid=5854 comm="smbclient" name="gencache.tdb"
scontext=unconfined_u:system_r:automount_t:s0
tcontext=unconfined_u:object_r:samba_var_t:s0 tclass=file

host=shuttle.config type=SYSCALL msg=audit(1201107605.256:131): arch=40000003
syscall=5 success=no exit=-13 a0=b83bcf70 a1=8042 a2=1a4 a3=8042 items=0
ppid=5853 pid=5854 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) comm="smbclient" exe="/usr/bin/smbclient"
subj=unconfined_u:system_r:automount_t:s0 key=(null)