[selinux-policy: 2586/3172] ksmtuned policy from Dan Walsh

[Daniel J Walsh]

commit d279dd603f04ce67f5803714167138e082451c0a
Author: Jeremy Solt <jsolt at tresys.com>
Date:   Wed Mar 24 10:29:39 2010 -0400

    ksmtuned policy from Dan Walsh
    
    Couple style/space fixes.
    Used ps_process_pattern in admin interface

 policy/modules/services/ksmtuned.fc |    5 ++
 policy/modules/services/ksmtuned.if |   76 +++++++++++++++++++++++++++++++++++
 policy/modules/services/ksmtuned.te |   44 ++++++++++++++++++++
 3 files changed, 125 insertions(+), 0 deletions(-)
---
diff --git a/policy/modules/services/ksmtuned.fc b/policy/modules/services/ksmtuned.fc
new file mode 100644
index 0000000..9c0c835
--- /dev/null
+++ b/policy/modules/services/ksmtuned.fc
@@ -0,0 +1,5 @@
+/etc/rc\.d/init\.d/ksmtuned	--	gen_context(system_u:object_r:ksmtuned_initrc_exec_t,s0)
+
+/usr/sbin/ksmtuned		--	gen_context(system_u:object_r:ksmtuned_exec_t,s0)
+
+/var/run/ksmtune\.pid		--	gen_context(system_u:object_r:ksmtuned_var_run_t,s0)
diff --git a/policy/modules/services/ksmtuned.if b/policy/modules/services/ksmtuned.if
new file mode 100644
index 0000000..62c7274
--- /dev/null
+++ b/policy/modules/services/ksmtuned.if
@@ -0,0 +1,76 @@
+
+## <summary>policy for Kernel Samepage Merging (KSM) Tuning Daemon</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run ksmtuned.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ksmtuned_domtrans',`
+	gen_require(`
+		type ksmtuned_t, ksmtuned_exec_t;
+	')
+
+	domtrans_pattern($1, ksmtuned_exec_t, ksmtuned_t)
+')
+
+
+########################################
+## <summary>
+##	Execute ksmtuned server in the ksmtuned domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ksmtuned_initrc_domtrans',`
+	gen_require(`
+		type ksmtuned_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, ksmtuned_initrc_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an ksmtuned environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`ksmtuned_admin',`
+	gen_require(`
+		type ksmtuned_t, ksmtuned_var_run_t;
+		type ksmtuned_initrc_exec_t;
+	')
+
+	allow $1 ksmtuned_t:process { ptrace signal_perms };
+	ps_process_pattern(ksmtumed_t)
+	        
+	files_list_pids($1)
+	admin_pattern($1, ksmtuned_var_run_t)
+
+	# Allow ksmtuned_t to restart the apache service
+	ksmtuned_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 ksmtuned_initrc_exec_t system_r;
+	allow $2 system_r;
+
+')
diff --git a/policy/modules/services/ksmtuned.te b/policy/modules/services/ksmtuned.te
new file mode 100644
index 0000000..b59c36b
--- /dev/null
+++ b/policy/modules/services/ksmtuned.te
@@ -0,0 +1,44 @@
+policy_module(ksmtuned,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ksmtuned_t;
+type ksmtuned_exec_t;
+init_daemon_domain(ksmtuned_t, ksmtuned_exec_t)
+
+type ksmtuned_initrc_exec_t;
+init_script_file(ksmtuned_initrc_exec_t)
+
+type ksmtuned_var_run_t;
+files_pid_file(ksmtuned_var_run_t)
+
+########################################
+#
+# ksmtuned local policy
+#
+allow ksmtuned_t self:capability { sys_ptrace sys_tty_config };
+
+# Init script handling
+domain_use_interactive_fds(ksmtuned_t)
+
+# internal communication is often done using fifo and unix sockets.
+allow ksmtuned_t self:fifo_file rw_file_perms;
+allow ksmtuned_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t)
+files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file)
+
+kernel_read_system_state(ksmtuned_t)
+
+dev_rw_sysfs(ksmtuned_t)
+
+domain_read_all_domains_state(ksmtuned_t)
+
+corecmd_exec_bin(ksmtuned_t)
+
+files_read_etc_files(ksmtuned_t)
+
+miscfiles_read_localization(ksmtuned_t)