[refpolicy] [PATCH v2 1/4] Puppet uses mount output for verification

Sven Vermeulen sven.vermeulen at siphos.be
Thu Sep 6 12:35:35 CDT 2012


Puppet calls mount to obtain the list of mounted file systems, redirecting its
output to a temporary file (labeled puppet_tmp_t). This allows the mount domain
to write to this resource.

Signed-off-by: Sven Vermeulen <sven.vermeulen at siphos.be>
---
 policy/modules/system/mount.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index 63931f6..4175ff7 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -193,6 +193,10 @@ optional_policy(`
 	')
 ')
 
+optional_policy(`
+	puppet_rw_tmp(mount_t)
+')
+
 # for kernel package installation
 optional_policy(`
 	rpm_rw_pipes(mount_t)
-- 
1.7.8.6



More information about the refpolicy mailing list