control:

  domain = ( localhost )
  AllowUsers = ( root )
  cfrunCommand = ( "/usr/sbin/cfagent" )

admit:

  /usr/sbin/cfagent localhost
  /var/cfengine/masterfiles localhost