[selinux-policy: 2516/3172] mcelog policy from Dan Walsh

[Daniel J Walsh]

commit 14841572013f8d77ac0d9abdf61d6b8d07568a51
Author: Jeremy Solt <jsolt at tresys.com>
Date:   Fri Mar 12 15:54:29 2010 -0500

    mcelog policy from Dan Walsh
    
    Me: Removed permissive line, and fixed a couple style issues

 policy/modules/admin/mcelog.fc |    1 +
 policy/modules/admin/mcelog.if |   21 +++++++++++++++++++++
 policy/modules/admin/mcelog.te |   30 ++++++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 0 deletions(-)
---
diff --git a/policy/modules/admin/mcelog.fc b/policy/modules/admin/mcelog.fc
new file mode 100644
index 0000000..56c43c0
--- /dev/null
+++ b/policy/modules/admin/mcelog.fc
@@ -0,0 +1 @@
+/usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
diff --git a/policy/modules/admin/mcelog.if b/policy/modules/admin/mcelog.if
new file mode 100644
index 0000000..d8e6121
--- /dev/null
+++ b/policy/modules/admin/mcelog.if
@@ -0,0 +1,21 @@
+
+## <summary>policy for mcelog</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run mcelog.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`mcelog_domtrans',`
+	gen_require(`
+		type mcelog_t, mcelog_exec_t;
+	')
+
+	domtrans_pattern($1, mcelog_exec_t, mcelog_t)
+')
+
diff --git a/policy/modules/admin/mcelog.te b/policy/modules/admin/mcelog.te
new file mode 100644
index 0000000..db49103
--- /dev/null
+++ b/policy/modules/admin/mcelog.te
@@ -0,0 +1,30 @@
+
+policy_module(mcelog,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type mcelog_t;
+type mcelog_exec_t;
+application_domain(mcelog_t, mcelog_exec_t)
+cron_system_entry(mcelog_t, mcelog_exec_t)
+
+########################################
+#
+# mcelog local policy
+#
+
+allow mcelog_t self:capability sys_admin;
+
+kernel_read_system_state(mcelog_t)
+
+dev_read_raw_memory(mcelog_t)
+dev_read_kmsg(mcelog_t)
+
+files_read_etc_files(mcelog_t)
+
+logging_send_syslog_msg(mcelog_t)
+
+miscfiles_read_localization(mcelog_t)