Description of problem:
SELinux is preventing autofs from reading the global.map file on an NFS share even when use_nfs_home_dirs=1 . 

Nov 18 12:59:06 XXXX automount[4867]: Starting automounter version 5.0.3-15, master map auto.master
Nov 18 12:59:06 XXXX automount[4867]: using kernel protocol version 5.00
Nov 18 12:59:06 XXXX automount[4867]: lookup(file): file map /xxx/dist/xxx/automaps/incr/common/etc/x.xxx.xxx.xxxx.xxx.com/global.map missing or not readable
Nov 18 12:59:06 XXXX automount[4867]: mount_autofs_indirect: failed to read map for /.efsglobal
Nov 18 12:59:06 XXXX automount[4867]: handle_mounts: mount of /.efsglobal failed!
Nov 18 12:59:06 XXXX automount[4867]: master_do_mount: failed to startup mount
Nov 18 12:59:06 XXXX automount[4867]: no mounts in table
Nov 18 12:59:06 XXXX setroubleshoot: SELinux prevented automount from reading files stored on a NFS filesytem. For complete SELinux messages. run sealert -l 67a06831-1f71-407c-acf5-505bdffc125c


[root@XXXX init.d]# sealert -l 67a06831-1f71-407c-acf5-505bdffc125c

Summary:

SELinux prevented automount from reading files stored on a NFS filesytem.

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

SELinux prevented automount from reading files stored on a NFS filesystem. NFS
(Network Filesystem) is a network filesystem commonly used on Unix / Linux
systems. automount attempted to read one or more files or directories from a
mounted filesystem of this type. As NFS filesystems do not support fine-grained
SELinux labeling, all files and directories in the filesystem will have the same
security context. If you have not configured automount to read files from a NFS
filesystem this access attempt could signal an intrusion attempt.

Allowing Access:

Changing the "use_nfs_home_dirs" boolean to true will allow this access:
"setsebool -P use_nfs_home_dirs=1"

Fix Command:

setsebool -P use_nfs_home_dirs=1

Additional Information:

Source Context                unconfined_u:system_r:automount_t:s0
Target Context                system_u:object_r:nfs_t:s0
Target Objects                ./global.map [ file ]
Source                        automount
Source Path                   /usr/sbin/automount
Port                          <Unknown>
Host                          XXXX.xxx.xxx.xx.xx.com
Source RPM Packages           autofs-5.0.3-15
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-107.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   use_nfs_home_dirs
Host Name                     XXX.xxx.xxx.xx.xx.com
Platform                      Linux XXXX.xxx.xxx.xx.xx.com
                              2.6.27.5-37.fc9.x86_64 #1 SMP Wed Nov 12 18:31:37
                              EST 2008 x86_64 x86_64
Alert Count                   10
First Seen                    Fri Nov 14 14:39:14 2008
Last Seen                     Tue Nov 18 13:36:18 2008
Local ID                      67a06831-1f71-407c-acf5-505bdffc125c
Line Numbers                  

Raw Audit Messages            

host=XXXX.xxx.xxx.xx.xx.com type=AVC msg=audit(1227033378.300:183): avc:  denied  { read } for  pid=5096 comm="automount" name="global.map" dev=0:17 ino=2185111 scontext=unconfined_u:system_r:automount_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file

host=XXXX.xxx.xxx.xx.xx.com type=SYSCALL msg=audit(1227033378.300:183): arch=c000003e syscall=21 success=yes exit=0 a0=7f1b47ca60f0 a1=4 a2=7f1b47ca07b0 a3=ccaa70 items=0 ppid=5090 pid=5096 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="automount" exe="/usr/sbin/automount" subj=unconfined_u:system_r:automount_t:s0 key=(null)


[root@XXXX init.d]# getsebool -a | grep nfs
allow_ftpd_use_nfs --> off
allow_nfsd_anon_write --> off
httpd_use_nfs --> off
nfs_export_all_ro --> on
nfs_export_all_rw --> on
qemu_use_nfs --> on
samba_share_nfs --> off
use_nfs_home_dirs --> on
virt_use_nfs --> off
xen_use_nfs --> off


Version-Release number of selected component (if applicable):
uname -a
Linux XXXX.xxx.xxx.xx.xx.com 2.6.27.5-37.fc9.x86_64 #1 SMP Wed Nov 12 18:31:37 EST 2008 x86_64 x86_64 x86_64 GNU/Linux
[

How reproducible:
Every time! 

Steps to Reproduce:
1. setsebool -P use_nfs_home_dirs=1
2. Setup autofs to use a global.map file from an NFS share. 
3. Start autofs

  
Actual results:
autofs is blocked from reading file. 

Expected results:
autofs will read file.