Description of problem:
SSO on RHEL6.5 not working because of SELinux

# grep denied /var/log/audit/audit.log 
type=AVC msg=audit(1383745541.043:442): avc:  denied  { create } for  pid=13105 comm="gdm-session-wor" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=guest_u:guest_r:oddjob_mkhomedir_t:s0 tclass=key
type=AVC msg=audit(1383745544.164:446): avc:  denied  { read } for  pid=1890 comm="ovirt-guest-age" name="online" dev=sysfs ino=23 scontext=system_u:system_r:rhev_agentd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
type=AVC msg=audit(1383745544.164:446): avc:  denied  { open } for  pid=1890 comm="ovirt-guest-age" name="online" dev=sysfs ino=23 scontext=system_u:system_r:rhev_agentd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file

# sealert -a /var/log/audit/audit.log 
100% donefound 2 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

SELinux is preventing /usr/libexec/gdm-session-worker from create access on the key .

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that gdm-session-worker should be allowed create access on the  key by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep gdm-session-wor /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


--------------------------------------------------------------------------------

SELinux is preventing /usr/bin/python from read access on the file online.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python should be allowed read access on the online file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep ovirt-guest-age /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

...snip...
Dummy-2::INFO::2013-11-06 14:45:39,075::OVirtAgentLogic::169::root::Received an external command: login...
Dummy-2::DEBUG::2013-11-06 14:45:39,075::OVirtAgentLogic::201::root::User log-in (credentials = '\x00\x00\x00,vdcadmin.lab.eng.brq.redhat.com*****
***\x00')
Dummy-2::INFO::2013-11-06 14:45:39,076::CredServer::207::root::The following users are allowed to connect: [0]
Dummy-2::DEBUG::2013-11-06 14:45:39,076::CredServer::272::root::Token: 776124
Dummy-2::INFO::2013-11-06 14:45:39,076::CredServer::273::root::Opening credentials channel...
Dummy-2::INFO::2013-11-06 14:45:39,078::CredServer::132::root::Emitting user authenticated signal (776124).
CredChannel::DEBUG::2013-11-06 14:45:39,198::CredServer::166::root::Receiving user's credential ret = 2 errno = 0
CredChannel::DEBUG::2013-11-06 14:45:39,198::CredServer::177::root::cmsgp: len=28 level=1 type=2
CredChannel::INFO::2013-11-06 14:45:39,198::CredServer::225::root::Incomming connection from user: 0 process: 13105
CredChannel::INFO::2013-11-06 14:45:39,198::CredServer::232::root::Sending user's credential (token: 776124)
Dummy-2::INFO::2013-11-06 14:45:39,199::CredServer::277::root::Credentials channel was closed.
Dummy-2::DEBUG::2013-11-06 14:45:39,199::OVirtAgentLogic::158::root::AgentLogicBase::doListen() - in loop before vio.read
Dummy-1::DEBUG::2013-11-06 14:45:44,165::OVirtAgentLogic::225::root::AgentLogicBase::sendUserInfo - cur_user = 'root'
Dummy-1::DEBUG::2013-11-06 14:45:44,213::GuestAgentLinux2::81::root::PkgMgr: list_pkgs returns [['kernel-2.6.32-430.el6', 'kernel-2.6.32-428.el6', 'rhevm-guest
-agent-common-1.0.8-4.el6ev', 'xorg-x11-drv-qxl-0.1.0-7.el6']]
Dummy-2::INFO::2013-11-06 14:45:47,556::OVirtAgentLogic::169::root::Received an external command: lock-screen...
Dummy-2::DEBUG::2013-11-06 14:45:47,557::GuestAgentLinux2::157::root::Executing lock session command: '['/usr/share/ovirt-guest-agent/ovirt-locksession']'
Dummy-2::DEBUG::2013-11-06 14:45:47,605::OVirtAgentLogic::158::root::AgentLogicBase::doListen() - in loop before vio.read
Dummy-2::INFO::2013-11-06 14:45:47,606::OVirtAgentLogic::169::root::Received an external command: lock-screen...
...snip...


Version-Release number of selected component (if applicable):
is21
redhat-guest-agent-common selinux-policy-targeted
package redhat-guest-agent-common is not installed
selinux-policy-targeted-3.7.19-231.el6.noarch
redhat-release-server-6Server-6.5.0.1.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. add guest OS into IPA (ipa-client-install --mkhomedir)
2. add your from IPA on the VM in RHEVM UI
3. try SSO from User Portal

Actual results:
selinux preventing SSO

Expected results:
should work

Additional info:
* with Permissive mode it works
* try with brq-ipa.rhev.lab.eng.brq.redhat.com (ask for info if needed)