Description of problem:

gnome-keyring-daemon is running in staff_t domain instead of staff_gkeyringd_t domain.


How reproducible:

Steps to Reproduce:
1. Setup an user to log in as staff_u
2. Log in as this user
3. Check /var/log/audit/audit.log


Actual results:

type=AVC msg=audit(1299604503.493:145): avc:  denied  { ipc_lock } for  pid=1486 comm="gnome-keyring-d" capability=14  scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=capability

type=SYSCALL msg=audit(1299604503.493:145): arch=c000003e syscall=149
success=yes exit=0 a0=7f2e63079000 a1=4000 a2=3 a3=22 items=0 ppid=1478 pid=1486 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="gnome-keyring-d" exe="/usr/bin/gnome-keyring-daemon" subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)

Additional info:

One solution is change pam_keyringd to execute "sh -c keyring"