Yeah, as per our discussion on IRC, this was coming from puppetmaster
and I didn't realize that. Removing that now.

LZ

On Wed, Jul 24, 2013 at 12:22:42AM -0700, Dominic Cleal wrote:
> > @@ -146,6 +151,17 @@ tunable_policy(`httpd_run_foreman', `
> >      allow httpd_t passenger_tmp_t:sock_file write;
> >  ')
> >  
> > +tunable_policy(`httpd_run_foreman', `
> > +    manage_dirs_pattern(passenger_t, httpd_tmp_t, httpd_tmp_t)
> > +    manage_files_pattern(passenger_t, httpd_tmp_t, httpd_tmp_t)
> > +    manage_sock_files_pattern(passenger_t, httpd_tmp_t, httpd_tmp_t)
> > +')
> > +
> > +tunable_policy(`httpd_run_foreman', `
> > +    corenet_tcp_connect_puppet_port(httpd_t)
> 
> why this?  There's no reason Foreman would connect to a puppetmaster.
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/theforeman/foreman-selinux/pull/4/files#r5365115

-- 
Later,

 Lukas "lzap" Zapletal
 irc: lzap #theforeman