Description of problem:

When I try to use GSS Proxy from Apache httpd, I get AVC denials

type=AVC msg=audit(1378278187.873:99): avc:  denied  { write } for  pid=1679 comm="httpd" name="default.sock" dev="dm-1" ino=2100982 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:gssproxy_var_lib_t:s0 tclass=sock_file
type=AVC msg=audit(1378278187.873:99): avc:  denied  { connectto } for pid=1679 comm="httpd" path="/var/lib/gssproxy/default.sock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:gssproxy_t:s0 tclass=unix_stream_socket

and I've also seen

type=AVC msg=audit(1378278175.323:97): avc:  denied  { search } for  pid=1677 comm="httpd" name="gssproxy" dev="dm-1" ino=2100970 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:gssproxy_var_lib_t:s0 tclass=dir

I can see two possibilities -- adding the necessary allows, something like

allow httpd_t gssproxy_t:unix_stream_socket connectto;
allow httpd_t gssproxy_var_lib_t:dir search;
allow httpd_t gssproxy_var_lib_t:sock_file write;

or

gssproxy_read_lib_files(httpd_t)
userdom_unpriv_type(httpd_t)

or having these behind some SELinux boolean.

Version-Release number of selected component (if applicable):

mod_auth_kerb-5.4-24.fc19.x86_64
httpd-2.4.6-2.fc19.x86_64
gssproxy-0.2.3-6.fc19.x86_64
selinux-policy-targeted-3.12.1-73.fc19.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. Set up Apache with GSS Proxy using for example the steps at https://fedorahosted.org/gss-proxy/wiki/Apache
2. kinit to get a valid ticket
3. Do a GET https request.

Actual results:

With enforcing, ISE 500 and some AVC denials.

In permissive, things works but more AVC denials.

Expected results:

Things working in enforcing without AVC denials, potentially with some boolean enabled to allow httpd_t to communicate with the GSS Proxy.

Additional info: