Description of problem: Version-Release number of selected component (if applicable): selinux-policy-3.7.19 puppet-3.4.2 ipa-client-3.0.0 How reproducible: Everytime Steps to Reproduce: 1. ipa-getcert request -K puppet/puppet.domain.local -D host.domain.local -k /var/lib/puppet/ssl/private_keys/host.domain.local.pem -f /var/lib/puppet/certs/host.domain.local.pem Actual results: The parent of location "/var/lib/puppet/certs/host.domain.local.pem" must be a valid directory. Expected results: New signing request "20140207011324" added. Additional info: type=AVC msg=audit(1391735605.335:443): avc: denied { read } for pid=18371 comm="certmonger" name="host.domain.local.pem" dev=vda1 ino=141260 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
Forgot to mentioned, this occurs because we are using IPA as the CA for puppet and therefore using ipa-getcert to request/place certificates into puppet
type=AVC msg=audit(1391735604.043:437): avc: denied { search } for pid=1282 comm="certmonger" name="puppet" dev=vda1 ino=142322 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
patch sent.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1568.html