CM sepolicy: mac_permissions.xml