puppetlabs/puppet — pull request #2997 by lzap (2014-08-20 13:20:36+00:00)
Title: (PUP-3094) - Adding separate binaries for SELinux

Downstream SELinux-aware distributions need to add shell wrappers for
"puppet master" and "puppet ca" command to be able set puppet_exec_t file
context for successful domain transition. Without this, it is not possible to
start master or ca process in the correct (secured) domain.

Puppet Enterprise customers who would like to use SELinux in their
environments need to create and set contexts for these wrappers manually.
Having this upstream would allow to support SELinux out-of-box.

The third binary "puppetagent" is for the same purpose. In rare cases,
customers may want to tighten security around running agents and this binary
allows to do the domain transition.