[CentOS] puppet files denied by SELinux

Sat Jun 20 15:50:12 UTC 2015
Joseph L. Casale <jcasale at activenetwerx.com>

> In my audit logs I found this entry:
> type=AVC msg=audit(1434769414.956:562): avc:  denied  { open } for
>  pid=3558 comm="ruby"
> path="/etc/puppet/environments/production/modules/bacula/files/monitor1/monitor1.mydomain.com.crt"
> dev="vda1" ino=1842005 scontext=system_u:system_r:passenger_t:s0
> tcontext=system_u:object_r:nfs_t:s0 tclass=file

Knowing nothing of your scenario, look at the source and target context.

Looks like you copied a crt from an nfs location and you don't have a
file context defined to transition labels, maybe something like:

semanage fcontext -a -t passenger_t "/etc/puppet/environments(/.*)?"

However, I know nothing of puppets selinux infrastructure, you may need
a more applicable  type.

In these cases, audit2allow can't possibly guess the right thing and will
certainly produce a rule that is either unsafe or simply wrong.