Description of problem:

SELinux policy version 3.7.19-306 appears to have restructured puppet module code to follow rhel7 puppet4 model, including changing /usr/bin/puppet binary to puppet_exec_t. 

It seems that introduced a regression where system administrators cannot execute 'puppet agent' command.  By default sysadm_t domain does not have transition rules to allow puppet to run in the puppet_t domain. Additional denials were generated because sysadmin_t does not have permissions to enter confined domains such as consoletype_t,  hostname_t, puppet_initrc_t etc to execute their 
respective commands. 

puppet_t does have permissions to enter those domains and run their  respective commands. Just like rhel7's version of the policy, 'puppet agent' command should
successfully transition to one of puppet's domain Instead of running in caller's domain. 

Following rhel7's model, rhel6's puppet module should export a couple of interfaces that would allow calling domain/role combination to transition to puppet_t domain.  Something like ..

########################################
## <summary>
##      Execute puppet in the puppet
##      domain.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed to transition.
## </summary>
## </param>
#
interface(`puppet_domtrans_puppet',`
        gen_require(`
                type puppet_t, puppet_exec_t;
        ')

        corecmd_search_bin($1)
        domtrans_pattern($1, puppet_exec_t, puppet_t)
')

#####################################
## <summary>
##      Execute puppet in the puppet
##      domain and allow the specified
##      role the puppet domain.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed to transition.
##      </summary>
## </param>
## <param name="role">
##      <summary>
##      Role allowed access.
##      </summary>
## </param>
## <rolecap/>
#
interface(`puppet_run_puppet',`
        gen_require(`
                type puppet_t, puppet_exec_t;
        ')

        puppet_domtrans_puppet($1)
        role $2 types puppet_t;
')

With these interfaces, appropriate system administrators could be allowed to execute puppet.


Version-Release number of selected component (if applicable):

- SELinux policy version 3.7.19-306 


How reproducible:

- Each time


Steps to Reproduce:
1. Create a rhel6 system with the latest selinux-policy rpm.
2. Install and setup puppet
3. ssh into the system and become system administrator using "sudo -ir sysadm_r"  or login locally on the system as root in sysadm_r role.
4. Run "puppet agent --test --noop"


Actual results:
- Selinux is denying this interaction


Expected results:
- As this works in the later RHEL 7, RHEL 6 should ideally reflect this behavior as well.