Create denial on nshadow when logging in with an expired password

Hi everyone, I'm running selinux-policy-strict 2.4.6-279.el5_5.1 (Redhat), and I get a denial when a user logs on (via SSH) with an expired password. The procedure for getting the new password goes fine, but the update of shadow fails and the login is refused. The audit messages are the following: type=USER_AUTH msg=audit(1282326913.918:472): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: authentication acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=failed)' type=USER_LOGIN msg=audit(1282326913.918:473): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='acct="testupgrader": exe="/usr/sbin/sshd" (hostname=?, addr=xx.xx.xx.xx, terminal=sshd res=failed)' type=USER_AUTH msg=audit(1282326917.387:474): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: authentication acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=USER_ACCT msg=audit(1282326917.388:475): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: accounting acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=failed)' type=CRED_ACQ msg=audit(1282326917.393:476): user pid=14136 uid=0 auid=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=LOGIN msg=audit(1282326917.393:477): login pid=14136 uid=0 old auid=4294967295 new auid=508 old ses=4294967295 new ses=26 type=USER_START msg=audit(1282326917.393:478): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: session open acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=CRED_REFR msg=audit(1282326917.394:479): user pid=14138 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=USER_LOGIN msg=audit(1282326917.397:480): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='uid=508: exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=/dev/pts/7 res=success)' type=AVC msg=audit(1282326929.157:481): avc: denied { create } for pid=14139 comm="passwd" name="nshadow" scontext=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file type=SYSCALL msg=audit(1282326929.157:481): arch=c000003e syscall=2 success=no exit=-13 a0=2ad97d295a33 a1=241 a2=1b6 a3=241 items=0 ppid=14138 pid=14139 auid=508 uid=508 gid=508 euid=0 suid=0 fsuid=0 egid=508 sgid=508 fsgid=508 tty=pts7 ses=26 comm="passwd" exe="/usr/bin/passwd" subj=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 key=(null) type=USER_CHAUTHTOK msg=audit(1282326931.330:482): user pid=14139 uid=508 auid=508 subj=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 msg='PAM: chauthtok acct="testupgrader" : exe="/usr/bin/passwd" (hostname=?, addr=?, terminal=pts/7 res=failed)' type=USER_CHAUTHTOK msg=audit(1282326931.330:483): user pid=14139 uid=508 auid=508 subj=e2ee_upgrader_u:e2ee_upgrader_r:e2ee_upgrader_t:s0 msg='op=change password id=508 exe="/usr/bin/passwd" (hostname=?, addr=?, terminal=pts/7 res=failed)' type=CRED_DISP msg=audit(1282326931.332:484): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: setcred acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' type=USER_END msg=audit(1282326931.332:485): user pid=14136 uid=0 auid=508 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='PAM: session close acct="testupgrader" : exe="/usr/sbin/sshd" (hostname=xx.xx.xx.xx, addr=xx.xx.xx.xx, terminal=ssh res=success)' Audit2allow suggests to add auth_manage_shadow(e2ee_upgrader_t) to the local policy, but that doesn't change anything. Neither does adding allow e2ee_upgrader_t shadow_t:file { create }. What is really strange is that the very same user (after its password has been changed by root) can run passwd and set its password without any problem. Any idea? Thanks in advance for any suggestion, Patrice.