Bug 1013109

Summary: Various denials when running the puppetmaster under Passenger as a rack app
Product: [Fedora] Fedora Reporter: Sam Kottler <skottler>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED INSUFFICIENT_DATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: dcleal, dominick.grift, dwalsh, lvrabec, mgrepl, ohadlevy
Target Milestone: ---Flags: mgrepl: needinfo? (skottler)
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-07-15 12:03:06 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Sam Kottler 2013-09-27 20:56:37 UTC 
Description of problem:

Here's the output of audit2allow:

allow passenger_t ifconfig_exec_t:file { read getattr open execute execute_no_trans };
allow passenger_t proc_net_t:file { read getattr open };
allow passenger_t puppet_etc_t:file { execute execute_no_trans };
allow passenger_t puppet_log_t:file { write relabelfrom relabelto };
allow passenger_t puppet_var_lib_t:dir { relabelfrom relabelto create rmdir setattr };
allow passenger_t puppet_var_lib_t:file { relabelfrom relabelto };

How reproducible:
This issue can always be reproduced when running the master under Passenger when enforcing.

Expected results:
The master will start without AVC denials.


Additional info:
Comment 1 Miroslav Grepl 2013-10-07 11:36:50 UTC 
What does

# ps -efZ |grep passenger