Description of problem:SELinux prevents a user login when using autofs and NFSv4 for home directory. NFSv3 works fine. NFS Server is Solaris10 SPARC.



Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-23.fc13.noarch

How reproducible: setenforce 0 allows home directory to be mounted


Steps to Reproduce:
1.Configure autofs to automount home directory usiong default settings (NFS4)
2.attempt login (defaults to / as user home directory as real home directory will not mount)
3.setenforce 0
4. attempt login (success)
  
Actual results:
Get / as home directory


Expected results:
Actual home directory

Additional info:
Using autofs-5.0.5-24.fc13.x86_64 to mount home directory 

*	-rw,intr,timeo=14			&:/homec/&

Home directory server is Solaris 10 SPARC box.

Changing the autofs to NFS3 successfully allows login with SELinux enabled
*	-rw,intr,timeo=14,rsize=8192,wsize=8192,vers=3	&:/homec/&

SELinux Error message
Summary:

SELinux is preventing /sbin/mount.nfs "read" access on solaris_nfs_server.

Detailed Description:

SELinux denied access requested by mount.nfs. It is not expected that this
access is required by mount.nfs and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:system_r:mount_t:s0
Target Context                system_u:object_r:nfs_t:s0
Target Objects                solaris_nfs_server [ lnk_file ]
Source                        mount.nfs
Source Path                   /sbin/mount.nfs
Port                          <Unknown>
Host                          f13-client
Source RPM Packages           nfs-utils-1.2.2-2.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-23.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     f13-client
Platform                      Linux f13-client 2.6.33.5-112.fc13.x86_64 #1 SMP Thu
                              May 27 02:28:31 UTC 2010 x86_64 x86_64
Alert Count                   68
First Seen                    Tue 15 Jun 2010 07:30:26 AM EST
Last Seen                     Tue 15 Jun 2010 08:38:15 AM EST
Local ID                      d2fa6432-f805-4a28-86f0-d3c3ec909283
Line Numbers                  

Raw Audit Messages            

node=f13-client type=AVC msg=audit(1276555095.896:28710): avc:  denied  { read } for  pid=5820 comm="mount.nfs" name="solaris_nfs_server" dev=0:19 ino=321557 scontext=unconfined_u:system_r:mount_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=lnk_file

node=f13-client type=SYSCALL msg=audit(1276555095.896:28710): arch=c000003e syscall=165 success=no exit=-13 a0=7fffe91ea8ef a1=7ff681234da0 a2=7ff67f88a8fb a3=0 items=0 ppid=5819 pid=5820 auid=60953 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="mount.nfs" exe="/sbin/mount.nfs" subj=unconfined_u:system_r:mount_t:s0 key=(null)