commit: 300f017b1807980f57f1578f8ac1ffdf49a4285e
Author: Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Fri Feb 18 18:25:04 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Feb 27 02:13:17 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=300f017b
puppet: Style fixes.
Signed-off-by: Chris PeBenito <pebenito <AT> ieee.org>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/admin/puppet.fc | 1 +
policy/modules/admin/puppet.te | 14 +++++++-------
2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/policy/modules/admin/puppet.fc b/policy/modules/admin/puppet.fc
index 001f21fe..42f3b7b2 100644
--- a/policy/modules/admin/puppet.fc
+++ b/policy/modules/admin/puppet.fc
@@ -12,6 +12,7 @@
/usr/sbin/puppetmasterd --
gen_context(system_u:object_r:puppetmaster_exec_t,s0)
/var/cache/puppet(/.*)? gen_context(system_u:object_r:puppet_cache_t,s0)
+
/var/lib/puppet(/.*)? gen_context(system_u:object_r:puppet_var_lib_t,s0)
/var/log/puppet(/.*)? gen_context(system_u:object_r:puppet_log_t,s0)
diff --git a/policy/modules/admin/puppet.te b/policy/modules/admin/puppet.te
index 7ef5ab83..9e312a17 100644
--- a/policy/modules/admin/puppet.te
+++ b/policy/modules/admin/puppet.te
@@ -20,6 +20,9 @@ type puppet_t;
type puppet_exec_t;
init_daemon_domain(puppet_t, puppet_exec_t)
+type puppet_cache_t;
+files_type(puppet_cache_t)
+
type puppet_etc_t;
files_config_file(puppet_etc_t)
@@ -36,9 +39,6 @@ init_daemon_runtime_file(puppet_runtime_t, dir, "puppet")
type puppet_tmp_t;
files_tmp_file(puppet_tmp_t)
-type puppet_cache_t;
-files_type(puppet_cache_t)
-
type puppet_var_lib_t;
files_type(puppet_var_lib_t)
@@ -73,10 +73,6 @@ allow puppet_t puppet_etc_t:dir list_dir_perms;
allow puppet_t puppet_etc_t:file read_file_perms;
allow puppet_t puppet_etc_t:lnk_file read_lnk_file_perms;
-manage_dirs_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
-manage_files_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
-can_exec(puppet_t, puppet_var_lib_t)
-
manage_dirs_pattern(puppet_t, puppet_cache_t, puppet_cache_t)
manage_files_pattern(puppet_t, puppet_cache_t, puppet_cache_t)
@@ -84,6 +80,10 @@ setattr_dirs_pattern(puppet_t, puppet_runtime_t,
puppet_runtime_t)
manage_files_pattern(puppet_t, puppet_runtime_t, puppet_runtime_t)
files_runtime_filetrans(puppet_t, puppet_runtime_t, { file dir })
+manage_dirs_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
+manage_files_pattern(puppet_t, puppet_var_lib_t, puppet_var_lib_t)
+can_exec(puppet_t, puppet_var_lib_t)
+
allow puppet_t puppet_log_t:dir { create_dir_perms setattr_dir_perms };
append_files_pattern(puppet_t, puppet_log_t, puppet_log_t)
create_files_pattern(puppet_t, puppet_log_t, puppet_log_t)
