ghost: Reduce permissiveness of SELinux policy

Change-Id: I5506a95dce47115edd5d45f6d371531add7ed4a5