[selinux] Re: Puppet 3 troubles on F19

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/30/2013 03:09 AM, Robin Lee Powell wrote:
> On Tue, Jul 30, 2013 at 08:56:39AM +0200, Miroslav Grepl wrote:
>> Could you please open a new bug with updated paths.
> 
> If it was just a matter of changing paths, I wouldn't have bothered with
> the email :).
> 
> What used to be puppetd is now run as "puppet agent", and what used to be
> run as puppetmasterd is now run as "puppet master".  There are a bunch of
> other options too.
> 
> This could, I guess, be fixed by having wrapper scripts to get to the old
> functions, but the systemd config does, in fact, do it the new way:
> ExecStart=/usr/bin/puppet master
> 
> I have no idea, at all, how to handle this properly.
> 
> -Robin -- selinux mailing list selinux at lists.fedoraproject.org 
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> 

Well if we want to get separation between the master and the agent we will
either need different entrypoints into the domain (Scripts).   Or we will need
to build SELinux knowledge into puppet.

Another solution would be to just make puppet into a single (very powerful
domain).  One thing we have talked about with puppet was to make i easy to
extend puppetd policy to allow it to manage certain domains.  puppetd_t would
be an unconfined domain but if you disabled the unconfined module then you
would use a tool like sepolicy generate to generate policy modules for the
domains puppetd_t will be administrating.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlH3qycACgkQrlYvE4MpobPq3QCfRf8X9DMUY/vEanwj0ErtEb4w
wJUAn2vSyGVXwuis7Ycc1saFPF7RWKC+
=NHHQ
-----END PGP SIGNATURE-----