am f821b5a7: allow shell dmesg

* commit 'f821b5a7':
  allow shell dmesg

app.te

@@ -318,7 +318,9 @@ neverallow { appdomain -unconfineddomain }
 
 # Access to syslog(2) or /proc/kmsg.
 neverallow { appdomain -system_app -unconfineddomain }
-    kernel:system { syslog_read syslog_mod syslog_console };
+    kernel:system { syslog_mod syslog_console };
+neverallow { appdomain -system_app -unconfineddomain -shelldomain }
+    kernel:system syslog_read;
 
 # Ability to perform any filesystem operation other than statfs(2).
 # i.e. no mount(2), unmount(2), etc.

shelldomain.te

@@ -32,3 +32,6 @@ allow shelldomain powerctl_prop:property_service set;
 # Directory read access and file write access is already granted
 # in domain.te.
 allow shelldomain debugfs:file r_file_perms;
+
+# allow shell to run dmesg
+allow shelldomain kernel:system syslog_read;