From: cpebenito@tresys.com (Christopher J. PeBenito) Date: Wed, 24 Aug 2011 09:11:47 -0400 Subject: [refpolicy] [PATCH 1/1] Allow puppet to mount partitions In-Reply-To: <20110823111220.GA5603@siphos.be> References: <20110823111220.GA5603@siphos.be> Message-ID: <4E54F893.2010809@tresys.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 08/23/11 07:12, Sven Vermeulen wrote: > Puppet is a management utility to manage several dozens or even hundreds of > systems through a single application. Part of its job is to ensure that the > configuration and state of a system is as expected. Part of this is to ensure > that the proper mounts are available and, if not, mount them (or umount them). > > This patch allows puppet_t to call mount. > > Signed-off-by: Sven Vermeulen > --- > policy/modules/services/puppet.te | 2 ++ > 1 files changed, 2 insertions(+), 0 deletions(-) > > diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te > index c11bf51..38cadee 100644 > --- a/policy/modules/services/puppet.te > +++ b/policy/modules/services/puppet.te > @@ -125,6 +125,8 @@ logging_send_syslog_msg(puppet_t) > miscfiles_read_hwdata(puppet_t) > miscfiles_read_localization(puppet_t) > > +mount_run(puppet_t, system_r) This should be a domtrans. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com