Bug 1410199 - SELinux prevents puppetmaster service from starting.
Summary: SELinux prevents puppetmaster service from starting.
Status: CLOSED DUPLICATE of bug 1376893
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.3
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: BaseOS QE Security Team
Depends On:
TreeView+ depends on / blocked
Reported: 2017-01-04 18:20 UTC by Fred Wittekind IV
Modified: 2017-01-05 10:55 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-01-05 10:55:37 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Fred Wittekind IV 2017-01-04 18:20:30 UTC
Description of problem:
Puppet Master service fails to start after update to 7.3, worked in 7.2

Version-Release number of selected component (if applicable):
CentOS Linux release 7.3.1611 (Core)
puppet-server-3.6.2-3.el7.noarch (from EPEL)
puppet-3.6.2-3.el7.noarch (from EPEL) 

How reproducible:

Steps to Reproduce:
1. systemctl start puppetmaster 
2. setenforce 0
3. systemctl start puppetmaster

Actual results:
start-puppet-master: /usr/bin/start-puppet-master: line 6: /usr/bin/puppet: Permission denied

Puppet master service starts after "setenforce 0"

Expected results:
Puppet master service should start with SELinux in enforcing mode.

Additional info:
# audit2allow <audit.log

#============= puppetmaster_t ==============
allow puppetmaster_t puppetagent_exec_t:file { execute execute_no_trans getattr ioctl open read };

Comment 1 Milos Malik 2017-01-05 09:42:15 UTC
I believe this bug is duplicate of BZ#1376893.

Comment 2 Lukas Vrabec 2017-01-05 10:55:37 UTC

*** This bug has been marked as a duplicate of bug 1376893 ***

Note You need to log in before you can comment on or make changes to this bug.