sepolicy: fix up remaining denials

Change-Id: I3ac486dee8e527d54f8ec60df995d577869394b7