Description of problem:
The krb5_child process attempts to read ~/.k5login but is denied by SELinux.


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-137.el6.noarch
sssd-1.8.0-4.el6.beta3.x86_64

How reproducible:
log into a RHEL6.3 system with SSSD

Steps to Reproduce:
1. log into a RHEL6.3 system with SSSD

Actual results:
AVC denial

Expected results:
no AVC denial

Additional info:
It seems that sssd_t is allowed to read home_root_t but not user_home_t:
# sesearch -s sssd_t -t home_root_t -c dir -p search --allow
Found 1 semantic av rules:
   allow sssd_t home_root_t : dir { getattr search open } ; 
# sesearch -s sssd_t -t user_home_t -c dir -p search --allow
# (blank)

SELinux contexts:
# ls -ldZ /home/ /home/remote/ /home/remote/jhrozek/
drwxr-xr-x. root    root    system_u:object_r:home_root_t:s0 /home/
drwxr-xr-x. root    root   unconfined_u:object_r:user_home_dir_t:s0 /home/remote/
drwxr-xr-x. jhrozek jhrozek unconfined_u:object_r:user_home_t:s0 /home/remote/jhrozek/

audit2why output:
type=AVC msg=audit(1330694985.161:52): avc:  denied  { search } for  pid=3028 comm="krb5_child" name="jhrozek" dev=sda3 ino=8913100 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1330694985.162:53): avc:  denied  { open } for  pid=3028 comm="krb5_child" name=".k5login" dev=sda3 ino=8913360 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1330694985.162:53): avc:  denied  { read } for  pid=3028 comm="krb5_child" name=".k5login" dev=sda3 ino=8913360 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.