Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <2dce0336-6e94-4ae2-6f9e-a1257962b20e@ieee.org>
Date:   Thu, 17 Feb 2022 08:49:53 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [PATCH] puppet patch V2
Content-Language: en-US
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <YgsIj5n4TxELgB3u@xev.coker.com.au> <3072740.2nxLzSqVoC@xev>
 <03c61997-4190-ed7d-d791-867858d1cb23@linux.microsoft.com>
 <3266491.hCnaqv1u2z@liv>
From:   Chris PeBenito <pebenito@ieee.org>
In-Reply-To: <3266491.hCnaqv1u2z@liv>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2/16/22 20:41, Russell Coker wrote:
> On Thursday, 17 February 2022 02:30:12 AEDT Chris PeBenito wrote:
>> On 2/16/2022 08:08, Russell Coker wrote:
>>> On Wednesday, 16 February 2022 22:35:58 AEDT Chris PeBenito wrote:
>>>> Why are you adding bin_t as an entrypoint here and below?
>>>
>>> That's for running a script via the interpreter instead of via a
>>> #!/usr/bin/ whatever so you can't just label the script file.
>>
>> I'm not sure I follow.  Are you saying this is for handling things like
>>    "bash -c /some/script" and "python foo.py"?
> 
> Yes.

I don't think we make this type of accomodation elsewhere in the policy, so I'm 
inclined to say no to this part of the change.

-- 
Chris PeBenito