Description of problem:

Running winbind on Fedora 18.

After updating selinux-policy-targeted, winbind daemons can no longer unlink/write to /var/tmp/host_0 with label 

system_u:object_r:krb5_host_rcache_t:s0

Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.11.1-87.fc18.noarch

How reproducible:

Attempt to ssh to system using winbind PAM module for logins after selinux-policy-targeted is updated to 3.11.1-87.fc18.noarch

Steps to Reproduce:
1. yum update selinux-policy selinux-policy-targeted
2. ssh to system
  
Actual results:

Login fails, messages appear in /var/log/audit.log:
type=AVC msg=audit(1365785661.223:72016): avc:  denied  { write } for  pid=22603 comm="winbindd" name="host_0" dev="dm-1" ino=920593 scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:object_r:krb5_host_rcache_t:s0 tclass=file
type=AVC msg=audit(1365785661.223:72017): avc:  denied  { unlink } for  pid=22603 comm="winbindd" name="host_0" dev="dm-1" ino=920593 scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:object_r:krb5_host_rcache_t:s0 tclass=file
type=AVC msg=audit(1365785662.923:72018): avc:  denied  { write } for  pid=22603 comm="winbindd" name="host_0" dev="dm-1" ino=920593 scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:object_r:krb5_host_rcache_t:s0 tclass=file


Expected results:

Successful login, no AVC deny messages in /var/log/audit.log.

Additional info:

I updated the selinux-policy and selinux-policy-targeted RPMs on two Fedora 18 systems that should be essentially identical in configuration, both using winbind to an Active Directory controller for PAM.

On one of the systems, /var/tmp/host_0 got relabeled (by the selinux-policy-targeted update?) to type krb5_host_rcache_t, whereupon logins started failing.

On the other system, /var/tmp/host_0 kept the type label 'user_tmp_t', and logins kept working.

I fixed the problem on the broken system by doing 'chcon -t user_tmp_t /var/tmp/host_0', but running 'restorecon -v -n /var/tmp/host_0' on each system shows that both systems think that 'krb5_host_rcache_t' is the proper type label for the file.

I haven't tried relabeling and rebooting either system, so I don't know if this problem would resolve with the new policy after a reboot, but I tried doing a 'systemctl restart winbind' several times on the affected system, and logins did not resume functioning until I manually relabeled /var/tmp/host_0 to user_tmp_t.

Running sealert on the error recorded in /var/log/messages gave the following:

SELinux is preventing /usr/sbin/winbindd (deleted) from write access on the file host_0.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that winbindd (deleted) should be allowed write access on the host_0 file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep winbindd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:winbind_t:s0
Target Context                system_u:object_r:krb5_host_rcache_t:s0
Target Objects                host_0 [ file ]
Source                        winbindd
Source Path                   /usr/sbin/winbindd (deleted)
Port                          <Unknown>
Host                          xportal2.arlut.utexas.edu
Source RPM Packages           samba-winbind-4.0.4-3.fc18.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-87.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     xportal2.arlut.utexas.edu
Platform                      Linux xportal2.arlut.utexas.edu
                              3.8.3-203.fc18.x86_64 #1 SMP Mon Mar 18 12:59:28
                              UTC 2013 x86_64 x86_64
Alert Count                   79
First Seen                    2013-04-12 10:13:41 CDT
Last Seen                     2013-04-12 11:54:37 CDT
Local ID                      5271b3fd-bec9-46ac-a988-a6a894e42719

Raw Audit Messages
type=AVC msg=audit(1365785677.314:72031): avc:  denied  { write } for  pid=25014 comm="winbindd" name="host_0" dev="dm-1" ino=920593 scontext=system_u:system_r:winbind_t:s0 tcontext=system_u:object_r:krb5_host_rcache_t:s0 tclass=file


type=SYSCALL msg=audit(1365785677.314:72031): arch=x86_64 syscall=open success=no exit=EACCES a0=23de060 a1=2 a2=180 a3=10 items=0 ppid=25013 pid=25014 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=winbindd exe=/usr/sbin/winbindd subj=system_u:system_r:winbind_t:s0 key=(null)

Hash: winbindd,winbind_t,krb5_host_rcache_t,file,write

audit2allow

#============= winbind_t ==============
allow winbind_t krb5_host_rcache_t:file write;

audit2allow -R
require {
        type winbind_t;
}

#============= winbind_t ==============
kerberos_filetrans_named_content(winbind_t)