The result of # grep AVC audit.log is:

type=AVC msg=audit(1255874337.277:570): avc:  denied  { create } for  pid=9520 comm="osa-dispatcher" scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:system_r:osa_dispatcher_t:s0 tclass=netlink_route_socket
type=AVC msg=audit(1255874337.277:571): avc:  denied  { bind } for  pid=9520 comm="osa-dispatcher" scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:system_r:osa_dispatcher_t:s0 tclass=netlink_route_socket
type=AVC msg=audit(1255874337.278:572): avc:  denied  { getattr } for  pid=9520 comm="osa-dispatcher" scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:system_r:osa_dispatcher_t:s0 tclass=netlink_route_socket
type=AVC msg=audit(1255874337.278:573): avc:  denied  { write } for  pid=9520 comm="osa-dispatcher" scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:system_r:osa_dispatcher_t:s0 tclass=netlink_route_socket
type=AVC msg=audit(1255874337.278:573): avc:  denied  { nlmsg_read } for  pid=9520 comm="osa-dispatcher" scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:system_r:osa_dispatcher_t:s0 tclass=netlink_route_socket
type=AVC msg=audit(1255874337.279:574): avc:  denied  { read } for  pid=9520 comm="osa-dispatcher" scontext=user_u:system_r:osa_dispatcher_t:s0 tcontext=user_u:system_r:osa_dispatcher_t:s0 tclass=netlink_route_socket
type=AVC msg=audit(1255874342.797:579): avc:  denied  { unlink } for  pid=10061 comm="httpd" name="ssl_mutex" dev=sda2 ino=1379492 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:httpd_log_t:s0 tclass=file
type=AVC msg=audit(1255874345.872:580): avc:  denied  { setpgid } for  pid=10110 comm="gogo.pl" scontext=user_u:system_r:spacewalk_monitoring_t:s0 tcontext=user_u:system_r:spacewalk_monitoring_t:s0 tclass=process
type=AVC msg=audit(1255874345.902:581): avc:  denied  { getattr } for  pid=10111 comm="gogo.pl" path="/var/run/winbindd/pipe" dev=sda2 ino=1245375 scontext=user_u:system_r:spacewalk_monitoring_t:s0 tcontext=system_u:object_r:winbind_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1255874345.903:582): avc:  denied  { write } for  pid=10111 comm="gogo.pl" name="pipe" dev=sda2 ino=1245375 scontext=user_u:system_r:spacewalk_monitoring_t:s0 tcontext=system_u:object_r:winbind_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1255874345.903:582): avc:  denied  { connectto } for  pid=10111 comm="gogo.pl" path="/var/run/winbindd/pipe" scontext=user_u:system_r:spacewalk_monitoring_t:s0 tcontext=system_u:system_r:winbind_t:s0 tclass=unix_stream_socket

Please provide output of

# rpm -qa | grep spacewalk

Thank you.

(In reply to comment #2)
> Please provide output of
> 
> # rpm -qa | grep spacewalk
> 
> Thank you.  

Ah, it's in the comment 0.

making clear what rules spacewalk and osa-dispatcher requires I assumed these rules within te files:

for spacewalk_monitoring_t
allow spacewalk_monitoring_t self:process setpgid;

for connection to samba maybe required as when the system does auth user from samba, as example, the system is part of M$ AD and 
/etc/nsswitch.conf contains
passwd:     files winbind
shadow:     files
group:      files winbind
/etc/pam.d/system-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_winbind.so use_first_pass cached_login require_membership_of=S-1-5-21-790525478-287218729-682003330-512
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so require_membership_of=S-1-5-21-790525478-287218729-682003330-512
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

samba_stream_connect_winbind(spacewalk_monitoring_t);

But really needed possibility for spacewalk-monitoring to connect to socket of winbind?

Regarding osa-dispatcher needs this rule to be added to te file:

allow osa_dispatcher_t self:netlink_route_socket create_netlink_socket_perms;

The necessity of dispatcher to netlink_route_socket I cannot answer...

Thank You

The setpgid was addressed in bug 516073.

Vasiliy, could you show your /etc/tnsnames.ora? I wonder what network access osa-dispatcher needs here.

 cat /etc/tnsnames.ora
invmgmt =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = TCP)(HOST = 172.20.40.77)(PORT = 1521))
    )
    (CONNECT_DATA =
      (SID = invmgmt)
    )
  )

I'd to add that Oracle server is located on another server and no XE.

The samba_stream_connect_winbind(spacewalk_monitoring_t) added to Spacewalk master 5d3d96cd5d57457de0b8c813adcb0321babc4e63.

Built packages spacewalk-monitoring-selinux-0.8.3-1.*, will be in the next nightly repo.

Spacewalk 0.8 has been released