#DESC dmesg - control kernel ring buffer

#

# Author:  Dan Walsh dwalsh@redhat.com

#

# X-Debian-Packages: util-linux

#################################

#

# Rules for the dmesg_t domain.

#

# dmesg_exec_t is the type of the dmesg executable.

#

# while sysadm_t has the sys_admin capability there is no point in using

# dmesg_t when run from sysadm_t, so we use nosysadm.

#

daemon_base_domain(dmesg, , `nosysadm')

#

# Rules used for dmesg

#

allow dmesg_t self:capability sys_admin;

allow dmesg_t kernel_t:system { syslog_read syslog_console syslog_mod };

allow dmesg_t admin_tty_type:chr_file { getattr read write };

allow dmesg_t sysadm_tty_device_t:chr_file ioctl;

allow dmesg_t var_log_t:file { getattr write };

read_locale(dmesg_t)

# for when /usr is not mounted

dontaudit dmesg_t file_t:dir search;