init: Fix service and invoke-rc.d contexts

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
netutils: make ping use capabilities

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
kernel: allow setattr to device files

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
kernel: don't audit access to special /proc files

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
kernel: get /proc/sys/vm/overcommit_memory from Fedora policy
xserver: merge part of Fedora policy
kernel: improve dontaudit restriction to /proc files

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
kernel: make /proc/irq a file type to have dontaudit statement from userdomains

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
userdomain: allow users to getattr /proc/mtrr

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
staff: make staff_r a wm role

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
Import part of xserver config from Fedora
xserver: import more policy from Fedora