Bug 752578 - Lots of SELinux denials for puppet agent
Summary: Lots of SELinux denials for puppet agent
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-09 22:08 UTC by Orion Poplawski
Modified: 2013-09-26 11:12 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-13 21:37:08 UTC
Type: ---

Attachments (Terms of Use)
puppet denials (10.77 KB, text/plain)
2011-11-09 22:08 UTC, Orion Poplawski 		no flags Details
puppet denials (9.32 KB, text/plain)
2011-11-11 19:08 UTC, Orion Poplawski 		no flags Details
puppet denials (10.68 KB, text/x-log)
2011-11-14 17:18 UTC, Orion Poplawski 		no flags Details
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Description Orion Poplawski 2011-11-09 22:08:18 UTC 
Created attachment 532684 [details]
puppet denials

Description of problem:

Denials from puppet-agent.  puppet_manage_all_files is off.

Version-Release number of selected component (if applicable):
puppet-2.6.12-1.fc17.noarch
selinux-policy-3.10.0-55.1.fc17.noarch
Comment 1 Miroslav Grepl 2011-11-10 07:10:50 UTC 
Dan added fixes to Rawhide.
Comment 2 Orion Poplawski 2011-11-11 19:08:43 UTC 
Created attachment 533151 [details]
puppet denials

Still seeing lots with selinux-policy-3.10.0-55.1.fc17.noarch
Comment 3 Miroslav Grepl 2011-11-13 21:37:08 UTC 
Try it with selinux-policy-3.10.0-57.fc17
Comment 4 Orion Poplawski 2011-11-14 17:18:26 UTC 
Created attachment 533578 [details]
puppet denials

Still lots of them.

selinux-policy-3.10.0-57.fc17.noarch
Comment 5 Lukas Zapletal 2013-09-26 10:50:40 UTC 
The question here is - do we want to confine puppet agent? Puppet agent does all the configuration on the machines. It is doing things as root. The policy needs to be quite open then. Maybe very permissive with only disabling unwanted things like accessing low-level API or devices?
Comment 6 Miroslav Grepl 2013-09-26 11:12:03 UTC 
puppet_t is very permissive domain. The problem here is how it is invoked now. Let's discuss it in the #1012360 bug.
Note You need to log in before you can comment on or make changes to this bug.