[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     37339854b5a11ef5686453e04f6c8dfba44097d0
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Dec 21 19:43:41 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Dec 21 19:43:41 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=37339854

Puppet runs statfs against selinuxfs

When dealing with SELinux information in puppet, puppet invokes binaries such as
getsebool and setsebool. These binaries run statfs against the selinuxfs mounts.
If the statfs returns failure, then these binaries return "SELinux is not
enabled" even though this is false.

---
 policy/modules/contrib/puppet.te |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/puppet.te b/policy/modules/contrib/puppet.te
index fc2b8f4..f857adb 100644
--- a/policy/modules/contrib/puppet.te
+++ b/policy/modules/contrib/puppet.te
@@ -382,6 +382,8 @@ ifdef(`distro_gentoo',`
 
 	usermanage_domtrans_passwd(puppet_t)
 
+	selinux_get_fs_mount(puppet_t)
+
 	tunable_policy(`puppet_manage_all_files',`
 		# We should use files_relabel_all_files here, but it calls
 		# seutil_relabelto_bin_policy which sets a "typeattribute type attr",