From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Tue, 23 Aug 2011 13:12:20 +0200 Subject: [refpolicy] [PATCH 1/1] Allow puppet to mount partitions Message-ID: <20110823111220.GA5603@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Puppet is a management utility to manage several dozens or even hundreds of systems through a single application. Part of its job is to ensure that the configuration and state of a system is as expected. Part of this is to ensure that the proper mounts are available and, if not, mount them (or umount them). This patch allows puppet_t to call mount. Signed-off-by: Sven Vermeulen --- policy/modules/services/puppet.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te index c11bf51..38cadee 100644 --- a/policy/modules/services/puppet.te +++ b/policy/modules/services/puppet.te @@ -125,6 +125,8 @@ logging_send_syslog_msg(puppet_t) miscfiles_read_hwdata(puppet_t) miscfiles_read_localization(puppet_t) +mount_run(puppet_t, system_r) + seutil_domtrans_setfiles(puppet_t) seutil_domtrans_semanage(puppet_t) -- 1.7.3.4