sepolicy: fix a few denials

Change-Id: I9e34b2c78416464fa80e2c2000d9f5b5aabec645