Use xattr-labeling for squashfs.

This is taken from the Fedora policy (authors: Dan Walsh, Miroslav
Grepl) and dates back to 2011 there.
Label fatsort as fsadm_exec_t.

FATsort is an utility to sort directory entries on FAT partitions, see
http://fatsort.sourceforge.net/ . It requires direct access to the
block devices.
Update contrib.
Add build-time distribution detection to Makefile

When using the same policy on several hosts with different Linux distributions
the DISTRO variable can't be defined in the build.conf of the build directory
because this file is tracked with git.

Instead of maintaining a local patch per host to define DISTRO in build.conf
or of building using "make DISTRO=...", this commit introduces a DISTRO_DETECT
boolean in build.conf which automatically fills DISTRO with the name of the
distro of the building host.

DISTRO_DETECT definition is not copied in the installed build.conf file
(/usr/share/selinux/refpolicy/include/build.conf) because this file would have
the DISTRO variable set.
Fix parallel build of the policy

Before this commit, "make -j2" would execute twice at the same time the rules
written to build tmp/all_post.conf because these rules were applied everytime
tmp/all_post.conf, tmp/all_attrs_types.conf and tmp/only_te_rules.conf needed
to be built. However, executing twice in parallel such line is buggy:

    $(GREP) '^fs_use_(xattr|task|trans)' $(tmpdir)/all_te_files.conf >> \
        tmpdir)/all_post.conf

This is why "make" reports following error for parallel builds:

    Compiling refpolicy-patched base module
    /usr/bin/checkmodule -M -U allow base.conf -o tmp/base.mod
    /usr/bin/checkmodule:  loading policy configuration from base.conf
    policy/modules/kernel/ubac.te":710:ERROR 'syntax error' at token
    'fs_use_trans' on line 26520:
    fs_use_trans devtmpfs system_u:object_r:device_t:s0;

    /usr/bin/checkmodule:  error(s) encountered while parsing configuration
    make: *** [tmp/base.mod] Erreur 1

This commit fixes this bug by splitting the rules in 3 different targets, in
both monolithic and modular builds.
xserver: add lightdm file contexts
userdomain: no longer allow unprivileged users to read kernel symbols

Unprivileged users don't need to read kallsyms and /boot/System.map.

This allow rule was introduced in the initial revision of userdomain.if in
2005, with commit b16c6b8c32a631a2e66265f6f60b664222760972:

    # cjp: why?
    bootloader_read_kernel_symbol_table($1_t)
Add fcontext for syslog-ng pidfile