Description of problem:

I use pam_mount to mount user's encrypted home. When the user logs in and logs out using ssh, AVC denials are logged.

Version-Release number of selected component (if applicable):

pam_mount-2.13-4.20130707git966c6bea.fc19.i686
selinux-policy-targeted-3.12.1-69.fc19.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. Have pam_mount configured in /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac and in /etc/security/pam_mount.conf.xml with

<volume user="user" fstype="crypt" path="/dev/vg_host/home-user-enc" mountpoint="/home/user" options="fstype=ext4"/>

2. Login in to the machine with ssh, then type exit.

Actual results:

AVC denials upon log on:

type=AVC msg=audit(1376748630.921:506): avc:  denied  { getattr } for  pid=1341 comm="sshd" path="/run/mount/utab" dev="tmpfs" ino=9458 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file
type=AVC msg=audit(1376748630.921:507): avc:  denied  { read write } for  pid=1341 comm="sshd" name="utab" dev="tmpfs" ino=9458 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file
type=AVC msg=audit(1376748630.921:507): avc:  denied  { open } for  pid=1341 comm="sshd" path="/run/mount/utab" dev="tmpfs" ino=9458 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file

AVC denitals upon log out:

type=AVC msg=audit(1376748638.756:518): avc:  denied  { execute } for  pid=1433 comm="sshd" name="mount.crypt" dev="dm-1" ino=267237 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
type=AVC msg=audit(1376748638.756:518): avc:  denied  { read open } for  pid=1433 comm="sshd" path="/usr/sbin/mount.crypt" dev="dm-1" ino=267237 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
type=AVC msg=audit(1376748638.756:518): avc:  denied  { execute_no_trans } for  pid=1433 comm="sshd" path="/usr/sbin/mount.crypt" dev="dm-1" ino=267237 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file
type=AVC msg=audit(1376748638.765:519): avc:  denied  { read } for  pid=1433 comm="umount.crypt" name="cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1376748638.765:519): avc:  denied  { open } for  pid=1433 comm="umount.crypt" path="/run/cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1376748638.765:520): avc:  denied  { lock } for  pid=1433 comm="umount.crypt" path="/run/cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1376748638.765:521): avc:  denied  { getattr } for  pid=1433 comm="umount.crypt" path="/run/cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1376748638.767:522): avc:  denied  { write } for  pid=1433 comm="umount.crypt" name="cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=AVC msg=audit(1376748639.303:523): avc:  denied  { read } for  pid=1433 comm="umount.crypt" name="dm-6" dev="devtmpfs" ino=25416 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
type=AVC msg=audit(1376748639.303:523): avc:  denied  { open } for  pid=1433 comm="umount.crypt" path="/dev/dm-6" dev="devtmpfs" ino=25416 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
type=AVC msg=audit(1376748639.304:524): avc:  denied  { getattr } for  pid=1433 comm="umount.crypt" path="/dev/mapper/control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
type=AVC msg=audit(1376748639.304:525): avc:  denied  { read write } for  pid=1433 comm="umount.crypt" name="control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
type=AVC msg=audit(1376748639.304:525): avc:  denied  { open } for  pid=1433 comm="umount.crypt" path="/dev/mapper/control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
type=AVC msg=audit(1376748639.306:526): avc:  denied  { ioctl } for  pid=1433 comm="umount.crypt" path="/dev/mapper/control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file
type=AVC msg=audit(1376748639.306:527): avc:  denied  { ipc_info } for  pid=1433 comm="umount.crypt" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system
type=AVC msg=audit(1376748639.308:528): avc:  denied  { read } for  pid=1433 comm="umount.crypt" name="queue.bin" dev="tmpfs" ino=25438 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file
type=AVC msg=audit(1376748639.308:528): avc:  denied  { open } for  pid=1433 comm="umount.crypt" path="/run/udev/queue.bin" dev="tmpfs" ino=25438 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file
type=AVC msg=audit(1376748639.309:529): avc:  denied  { getattr } for  pid=1433 comm="umount.crypt" path="/run/udev/queue.bin" dev="tmpfs" ino=25438 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file

This is under permissive.

Expected results:

No AVC denials.

Additional info: