Merge pull request #1184 from jcpunk/rasdaemon-ipmi

rasdaemon: optionally permit access to IPMI devices

Author: pebenito

policy/modules/services/rasdaemon.te

@@ -17,6 +17,14 @@ files_type(rasdaemon_var_t)
 # Local policy
 #
 
+gen_tunable(rasdaemon_use_ipmitool, false)
+
+## <desc>
+##	<p>
+##	Determine whether rasdaemon can use ipmitool to access IPMI devices.
+##	</p>
+## </desc>
+
 allow rasdaemon_t self:process getsched;
 allow rasdaemon_t self:capability sys_rawio;
 
@@ -40,3 +48,7 @@ fs_rw_tracefs_files(rasdaemon_t)
 logging_send_syslog_msg(rasdaemon_t)
 miscfiles_read_localization(rasdaemon_t)
 
+tunable_policy(`rasdaemon_use_ipmitool',`
+	ipmitool_domtrans(rasdaemon_t)
+')
+