Description of problem:
Samba refuses authentication when configured with security=ads

Version-Release number of selected component (if applicable):
2.6.4-13.fc7

How reproducible:
access samba from a windows client in security=ads mode

Steps to Reproduce:
1. Join samba to an AD domain
2. Try to access the server from a windows client
  
Actual results:
access denied

Expected results:
Access allowed

Additional info:
The problem seem to be related to a policy blocking smbd from accessing the
kerberos replay cache.

AVC log:
type=AVC msg=audit(1181334367.409:23585): avc:  denied  { getattr } for 
pid=3113 comm="smbd" name="rhfc7-044_0" dev=dm-0 ino=979997
scontext=system_u:system_r:smbd_t:s0 tcontext=root:object_r:winbind_tmp_t:s0
tclass=file
type=SYSCALL msg=audit(1181334367.409:23585): arch=40000003 syscall=195
success=no exit=-13 a0=8112b578 a1=bfb36e38 a2=c39ff4 a3=8112b578 items=0
ppid=2281 pid=3113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="smbd" exe="/usr/sbin/smbd"
subj=system_u:system_r:smbd_t:s0 key=(null)     
type=AVC_PATH msg=audit(1181334367.409:23585):  path="/var/tmp/rhfc7-044_0"
         
Samba log:
[2007/06/08 16:26:07, 1] libads/kerberos_verify.c:ads_verify_ticket(397)
  ads_verify_ticket: krb5_get_server_rcache failed (Permission denied in replay
cache code)  
[2007/06/08 16:26:07, 10] passdb/secrets.c:secrets_named_mutex_release(942)
  secrets_named_mutex: released mutex for replay cache mutex
[2007/06/08 16:26:07, 1] smbd/sesssetup.c:reply_spnego_kerberos(316)
  Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
    
Selinux configuration:
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted