Allow semodule to create symlink in semanage_store_t

With new userspace, trying to build a SELinux policy (and load it)
fails:

~# semodule -B
libsemanage.semanage_install_active: Unable to create sybolic link from
/etc/selinux/mcs/modules/active/policy.kern to
/etc/selinux/mcs/policy/policy.28 error code 0. (Permission denied).

AVC shows a denial for the semodule command, running as semanage_t,
trying to create a lnk_file in semanage_module_t.
Allow capabilities for syslog-ng

The syslog-ng logger has (build-optional) support for capabilities. If
capabilities support is enabled, running it without setcap/getcap
permissions gives the following upon start:

 * Starting syslog-ng ...
syslog-ng: Error setting capabilities, capability management disabled;
error='Permission denied' [ ok ]

Granting only setcap (initial AVC seen) does not fully help either:

 * Starting syslog-ng ...
 Error managing capability set, cap_set_proc returned an error;

With setcap and getcap enabled, syslog-ng starts and functions fine.

See also https://bugs.gentoo.org/show_bug.cgi?id=488718

Reported-by: Vincent Brillault <gentoo@lerya.net>
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Add comments about new capabilities for syslogd_t.
Module version bumps for syslog-ng and semodule updates.
Update contrib.
mount: fs_list_auto_mountpoint() is now redundant because autofs_t is covered by files_list_all_mountpoints()

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
udev: this fc spec does not make sense, as there is no corresponding file type transition for it

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
udev: the avahi dns check script run by udev in Debian chmods /run/avahi-daemon

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
authlogin: unix_chkpwd traverses / on sysfs device on Debian

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
setrans: mcstransd reads filesystems file in /proc

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
udev: reads modules config: /etc/modprobe.d/alsa-base-blacklist.conf

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
fstools: hdparm append (what seems inherited from devicekit ) /var/log/pm-powersave.log fstools: hdparm reads /run/pm-utils/locks/pm-powersave.lock

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
sysnetwork: dhcpc: networkmanager interface calls from Fedora. In Debian i was able to confirm the need for networkmanager_manage_lib_files(dhcpc_t) since dhclient reads /var/lib/NetworkManager/dhclient-eth0.conf

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
sysbnetwork: dhclient searches /var/lib/ntp

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
sshd/setrans: make respective init scripts create pid dirs with proper contexts

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
kernel: cryptomgr_test (kernel_t) requests kernel to load cryptd(__driver-ecb-aes-aesni

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
xserver: already allowed by auth_login_pgm_domain(xdm_t)

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
unconfined: Do not domain transition to xserver_t (unconfined_t is xserver_unconfined)

It would not be sufficient in the current shape anyways because
unconfined_r is not associated with xserver_t

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
Module version bump for first batch of patches from Dominick Grift.
Update contrib.