+++ This bug was initially created as a clone of Bug #447878 +++

Description of problem:
The following selinux denials appear whenever I start create a pdf with the
Cups-PDF printer:

Summary:

SELinux is preventing sh (cups_pdf_t) "search" to ./nscd (nscd_var_run_t).

Detailed Description:

SELinux denied access requested by sh. It is not expected that this access is
required by sh and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./nscd,

restorecon -v './nscd'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:cups_pdf_t:SystemLow-SystemHigh
Target Context                system_u:object_r:nscd_var_run_t
Target Objects                ./nscd [ dir ]
Source                        cups-pdf
Source Path                   /usr/lib/cups/backend/cups-pdf
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           bash-3.2-22.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-55.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 2.6.25.3-18.fc9.i686
                              #1 SMP Tue May 13 05:38:53 EDT 2008 i686 athlon
Alert Count                   24
First Seen                    Mon 26 May 2008 09:48:08 PM EDT
Last Seen                     Tue 27 May 2008 01:34:34 AM EDT
Local ID                      d5aacd9d-9cd8-4c07-bd23-2588ee7b20c1
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1211866474.411:40): avc:  denied 
{ search } for  pid=15121 comm="sh" name="nscd" dev=sda2 ino=98378
scontext=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023
tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir

host=localhost.localdomain type=SYSCALL msg=audit(1211866474.411:40):
arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfa7c070 a2=9f2ff4 a3=0
items=0 ppid=15120 pid=15121 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="sh"
exe="/bin/bash" subj=system_u:system_r:cups_pdf_t:s0-s0:c0.c1023 key=(null)


Version-Release number of selected component (if applicable):
selinux-policy.noarch 3.3.1-55.fc9

How reproducible:
always

Steps to Reproduce:
1. Install Fedora 9
2. set selinux to targeted mode
3. print something to a pdf using Cups-PDF
(not the Cairo "Create a PDF document" ... that produces no selinux errors)
  
Actual results:
selinux denials pop up in setroubleshoot
The PDF does get generated though

Expected results:
The PDF getting generated without selinux fuss.

Additional info: