Bug 479773

Description of problem:

selinux is preventing authentication via NIS.  Using su to become the user works fine, but login, either via the console, gdm or ssh fails.

$ ssh sam@gondor
Connection closed by 192.168.0.10

from audit.log:

type=USER_ACCT msg=audit(1231805174.212:45): user pid=3196 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="sam" exe="/usr/sbin/sshd" (hostname=rivendell.middle-earth.co.uk, addr=192.168.0.1, terminal=ssh res=failed)'
type=USER_LOGIN msg=audit(1231805174.212:46): user pid=3196 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='acct="sam": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.0.1, terminal=sshd res=failed)'

# getsebool use_nfs_home_dirs
use_nfs_home_dirs --> on

# getsebool allow_ypbind
allow_ypbind --> on

# authconfig --test
caching is disabled
nss_files is always enabled
nss_compat is disabled
nss_db is disabled
nss_hesiod is disabled
 hesiod LHS = ""
 hesiod RHS = ""
nss_ldap is disabled
 LDAP+TLS is disabled
 LDAP server = "ldap://127.0.0.1/"
 LDAP base DN = "dc=example,dc=com"
nss_nis is enabled
 NIS server = "192.168.0.1"
 NIS domain = "middle-earth.co.uk"
nss_nisplus is disabled
nss_winbind is disabled
 SMB workgroup = "MYGROUP"
 SMB servers = ""
 SMB security = "user"
 SMB realm = ""
 Winbind template shell = "/bin/false"
 SMB idmap uid = "16777216-33554431"
 SMB idmap gid = "16777216-33554431"
nss_wins is disabled
DNS preference over NSS or WINS is disabled
pam_unix is always enabled
 shadow passwords are enabled
 password hashing algorithm is sha512
pam_krb5 is disabled
 krb5 realm = "EXAMPLE.COM"
 krb5 realm via dns is disabled
 krb5 kdc = "kerberos.example.com:88"
 krb5 kdc via dns is disabled
 krb5 admin server = "kerberos.example.com:749"
pam_ldap is disabled
 LDAP+TLS is disabled
 LDAP server = "ldap://127.0.0.1/"
 LDAP base DN = "dc=example,dc=com"
pam_pkcs11 is disabled
 use only smartcard for login is disabled
 smartcard module = "coolkey"
 smartcard removal action = "Ignore"
pam_smb_auth is disabled
 SMB workgroup = "MYGROUP"
 SMB servers = ""
pam_winbind is disabled
 SMB workgroup = "MYGROUP"
 SMB servers = ""
 SMB security = "user"
 SMB realm = ""
pam_cracklib is enabled (try_first_pass retry=3)
pam_passwdqc is disabled ()
pam_access is disabled ()
pam_mkhomedir is disabled ()
Always authorize local users is disabled ()
Authenticate system accounts against network services is disabled

Version-Release number of selected component (if applicable):

F10 (both with original install and now with latest updates)

How reproducible:

Attempt to login using account information stored on a remote NIS server.

Steps to Reproduce:
1. Enter NIS username + password
2.
3.
  
Actual results:
Login fails with correct username+password.

Expected results:
Login allowed.

Additional info:
This is clearly due to selinux as 'setenforce 0' or changing to permissive mode in /etc/selinux/config allows the login.