Where do you see vda? In the denial line? Sure, but the rule I just pushed is generic:

```
tunable_policy(`httpd_run_foreman', `
    corenet_tcp_connect_puppet_port(httpd_t)
    puppet_read_config(httpd_t)
')
```