ksmtuned policy from Dan Walsh

Couple style/space fixes.
Used ps_process_pattern in admin interface

policy/modules/services/ksmtuned.fc

@@ -0,0 +1,5 @@
+/etc/rc\.d/init\.d/ksmtuned	--	gen_context(system_u:object_r:ksmtuned_initrc_exec_t,s0)
+
+/usr/sbin/ksmtuned		--	gen_context(system_u:object_r:ksmtuned_exec_t,s0)
+
+/var/run/ksmtune\.pid		--	gen_context(system_u:object_r:ksmtuned_var_run_t,s0)

policy/modules/services/ksmtuned.if

@@ -0,0 +1,76 @@
+
+## <summary>policy for Kernel Samepage Merging (KSM) Tuning Daemon</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run ksmtuned.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ksmtuned_domtrans',`
+	gen_require(`
+		type ksmtuned_t, ksmtuned_exec_t;
+	')
+
+	domtrans_pattern($1, ksmtuned_exec_t, ksmtuned_t)
+')
+
+
+########################################
+## <summary>
+##	Execute ksmtuned server in the ksmtuned domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ksmtuned_initrc_domtrans',`
+	gen_require(`
+		type ksmtuned_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, ksmtuned_initrc_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an ksmtuned environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`ksmtuned_admin',`
+	gen_require(`
+		type ksmtuned_t, ksmtuned_var_run_t;
+		type ksmtuned_initrc_exec_t;
+	')
+
+	allow $1 ksmtuned_t:process { ptrace signal_perms };
+	ps_process_pattern(ksmtumed_t)
+	        
+	files_list_pids($1)
+	admin_pattern($1, ksmtuned_var_run_t)
+
+	# Allow ksmtuned_t to restart the apache service
+	ksmtuned_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 ksmtuned_initrc_exec_t system_r;
+	allow $2 system_r;
+
+')

policy/modules/services/ksmtuned.te

@@ -0,0 +1,44 @@
+policy_module(ksmtuned,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ksmtuned_t;
+type ksmtuned_exec_t;
+init_daemon_domain(ksmtuned_t, ksmtuned_exec_t)
+
+type ksmtuned_initrc_exec_t;
+init_script_file(ksmtuned_initrc_exec_t)
+
+type ksmtuned_var_run_t;
+files_pid_file(ksmtuned_var_run_t)
+
+########################################
+#
+# ksmtuned local policy
+#
+allow ksmtuned_t self:capability { sys_ptrace sys_tty_config };
+
+# Init script handling
+domain_use_interactive_fds(ksmtuned_t)
+
+# internal communication is often done using fifo and unix sockets.
+allow ksmtuned_t self:fifo_file rw_file_perms;
+allow ksmtuned_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t)
+files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file)
+
+kernel_read_system_state(ksmtuned_t)
+
+dev_rw_sysfs(ksmtuned_t)
+
+domain_read_all_domains_state(ksmtuned_t)
+
+corecmd_exec_bin(ksmtuned_t)
+
+files_read_etc_files(ksmtuned_t)
+
+miscfiles_read_localization(ksmtuned_t)