Description of problem:

On RHEL6 beta2, with selinux-policy-3.7.19-29.el6.noarch and openssh-clients-5.3p1-18.el6.x86_64, when a user is created and specified
as staff_u or user_u , ssh ProxyCommand cannot be run. 

Version-Release number of selected component (if applicable):

selinux-policy-3.7.19-29.el6.noarch
openssh-clients-5.3p1-18.el6.x86_64


Steps to Reproduce:
1. Create a user 
$useradd testuser 

2. Specify as staff_u or user_u to the newly created user 
semanage login -a -s staff_u -r s0-s0:c0.c1023 testuser

3. Login as testuser 

4. Attempt to run ssh with ProxyCommands 
ssh -o 'ProxyCommand ssh -q gw.example.org nc %h 22' workstation.example.org
  
Actual results:

/bin/bash: /usr/bin/ssh: Permission denied
/bin/bash: /usr/bin/ssh: Success
ssh_exchange_identification: Connection closed by remote host

type=AVC msg=audit(1286897469.238:4236): avc: denied { execute_no_trans } for pid=12727 comm="bash" path="/usr/bin/ssh" dev=dm-1 ino=550124 scontext=staff_u:staff_r:ssh_t:s0 tcontext=system_u:object_r:ssh_exec_t:s0 tclass=file

type=SYSCALL msg=audit(1286897469.238:4236): arch=c000003e syscall=59 success=no exit=-13 a0=9b3460 a1=9b3130 a2=9b14a0 a3=8 items=0 ppid=12726 pid=12727 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=tty2 ses=671 comm="bash" exe="/bin/bash" subj=staff_u:staff_r:ssh_t:s0 

Expected results:

ssh ProxyCommand should be run.