From 14841572013f8d77ac0d9abdf61d6b8d07568a51 Mon Sep 17 00:00:00 2001
From: Jeremy Solt <jsolt@tresys.com>
Date: Fri, 12 Mar 2010 15:54:29 -0500
Subject: [PATCH] mcelog policy from Dan Walsh

Me: Removed permissive line, and fixed a couple style issues
---
 policy/modules/admin/mcelog.fc |  1 +
 policy/modules/admin/mcelog.if | 21 +++++++++++++++++++++
 policy/modules/admin/mcelog.te | 30 ++++++++++++++++++++++++++++++
 3 files changed, 52 insertions(+)
 create mode 100644 policy/modules/admin/mcelog.fc
 create mode 100644 policy/modules/admin/mcelog.if
 create mode 100644 policy/modules/admin/mcelog.te

diff --git a/policy/modules/admin/mcelog.fc b/policy/modules/admin/mcelog.fc
new file mode 100644
index 000000000..56c43c087
--- /dev/null
+++ b/policy/modules/admin/mcelog.fc
@@ -0,0 +1 @@
+/usr/sbin/mcelog	--	gen_context(system_u:object_r:mcelog_exec_t,s0)
diff --git a/policy/modules/admin/mcelog.if b/policy/modules/admin/mcelog.if
new file mode 100644
index 000000000..d8e612191
--- /dev/null
+++ b/policy/modules/admin/mcelog.if
@@ -0,0 +1,21 @@
+
+## <summary>policy for mcelog</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run mcelog.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`mcelog_domtrans',`
+	gen_require(`
+		type mcelog_t, mcelog_exec_t;
+	')
+
+	domtrans_pattern($1, mcelog_exec_t, mcelog_t)
+')
+
diff --git a/policy/modules/admin/mcelog.te b/policy/modules/admin/mcelog.te
new file mode 100644
index 000000000..db491035f
--- /dev/null
+++ b/policy/modules/admin/mcelog.te
@@ -0,0 +1,30 @@
+
+policy_module(mcelog,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type mcelog_t;
+type mcelog_exec_t;
+application_domain(mcelog_t, mcelog_exec_t)
+cron_system_entry(mcelog_t, mcelog_exec_t)
+
+########################################
+#
+# mcelog local policy
+#
+
+allow mcelog_t self:capability sys_admin;
+
+kernel_read_system_state(mcelog_t)
+
+dev_read_raw_memory(mcelog_t)
+dev_read_kmsg(mcelog_t)
+
+files_read_etc_files(mcelog_t)
+
+logging_send_syslog_msg(mcelog_t)
+
+miscfiles_read_localization(mcelog_t)