Description of problem:

SEalert complains about dovecot after each dovecot start:

SELinux is preventing /usr/libexec/dovecot/auth from execute access on the file /lib64/security/pam_krb5/pam_krb5_storetmp.

Version-Release number of selected component (if applicable):

selinux-policy-3.9.16-32.fc15.noarch

How reproducible:

Everytime I use imap to access folders on my fedora.

Steps to Reproduce:
1. Start dovecot
2. Access imaps folder on thunderbird
3.
  
Actual results:

SE alert appears

Expected results:

No SE alert

Additional info:

SELinux is preventing /usr/libexec/dovecot/auth from execute access on the file /lib64/security/pam_krb5/pam_krb5_storetmp.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that auth should be allowed execute access on the pam_krb5_storetmp file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep auth /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:dovecot_auth_t:s0
Target Context                system_u:object_r:bin_t:s0
Target Objects                /lib64/security/pam_krb5/pam_krb5_storetmp [ file
                              ]
Source                        auth
Source Path                   /usr/libexec/dovecot/auth
Port                          <Unknown>
Host                          whipper
Source RPM Packages           dovecot-2.0.13-1.fc15
Target RPM Packages           pam_krb5-2.3.11-4.fc15
Policy RPM                    selinux-policy-3.9.16-32.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     whipper
Platform                      Linux whipper
                              2.6.38.8-32.fc15.x86_64 #1 SMP Mon Jun 13 19:49:05
                              UTC 2011 x86_64 x86_64
Alert Count                   794
First Seen                    Tue 03 May 2011 10:15:55 AM EEST
Last Seen                     Tue 12 Jul 2011 09:05:57 AM EEST
Local ID                      17e0c871-c61a-451e-8f29-88aaab08d0f5

Raw Audit Messages
type=AVC msg=audit(1310450757.839:8414): avc:  denied  { execute } for  pid=18638 comm="auth" name="pam_krb5_storetmp" dev=dm-5 ino=3651 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file


type=SYSCALL msg=audit(1310450757.839:8414): arch=x86_64 syscall=execve success=no exit=EACCES a0=7fc7e1ce14c8 a1=7fff39e7b4f0 a2=99b840 a3=0 items=0 ppid=18636 pid=18638 auid=4294967295 uid=10066861 gid=500 euid=10066861 suid=10066861 fsuid=10066861 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm=auth exe=/usr/libexec/dovecot/auth subj=system_u:system_r:dovecot_auth_t:s0 key=(null)

Hash: auth,dovecot_auth_t,bin_t,file,execute

audit2allow

#============= dovecot_auth_t ==============
allow dovecot_auth_t bin_t:file execute;

audit2allow -R

#============= dovecot_auth_t ==============
allow dovecot_auth_t bin_t:file execute;