Label /usr/lib/networkmanager/ like /usr/lib/NetworkManager/

On ArchLinux the directory name of Network Manager in /usr/lib is
written in lowercase but not the files in /usr/bin, /var/lib, etc.

While at it, remove an useless backslash before a minus character.
Label /var/spool/postfix/dev/ files

On Debian, /var/spool/postfix/dev contains log, urandom and random in
the same types as the files in /dev.
Remove redundant Gentoo-specific term_append_unallocated_ttys(syslogd_t)

Since commit 0fd9dc55, logging.te contains:

  term_write_all_user_ttys(syslogd_t)

As "write" is a superset of "append", this rule is no longer needed:

    term_append_unallocated_ttys(syslogd_t)
Fix typo in fs_getattr_all_fs description
Add attribute file_type to pseudo filesystem types

Files in /sys/kernel/config are labeled configfs_t so this type needs
attribute "file_type".  Without this attribute, these denials happen
when using collectd with "df" plugin (this plugin enumerate mountpoints
and collect disk usage stats):

    avc:  denied  { getattr } for pid=872 comm="collectd"
    path="/sys/kernel/config" dev="configfs" ino=10234
    scontext=system_u:system_r:collectd_t
    tcontext=system_u:object_r:configfs_t tclass=dir

As collectd.te already contains files_getattr_all_dirs(collectd_t),
adding file_type to configfs_t is enough to allow this access.

Moreover, similar filesystems such as debugfs_t already has file_type:

    $ seinfo -xtdebugfs_t
       debugfs_t
          file_type
          filesystem_type
          non_security_file_type
          mountpoint
          non_auth_file_type
    $ seinfo -xtconfigfs_t
       configfs_t
          filesystem_type

This is because kernel.te contains files_mountpoint(debugfs_t), which
uses files_type(debugfs_t).

This patch adds files_type() to every pseudo filesystem type that
doesn't have file_type yet.
Add socket and dccp_socket to socket_class_set
Add ioctl and lock to manage_lnk_file_perms

manage_lnk_file_perms permission set should be larger than
write_lnk_file_perms and therefore include ioctl and lock.
Label (/var)?/tmp/systemd-private-.../tmp like /tmp

Such directories are used by systemd as private mountpoints for
services.
[WIP] Allow using /sys/fs/cgroup symlinks
-- WIP: need to be tested with systemd before sent to upstream

On ArchLinux, /sys/fs/cgroup contains 2 symbolic links:

* cpu -> cpu,cpuacct
* cpuacct -> cpu,cpuacct

As programs use these links like normal directory, allow them to follow
them when allowing search access to cgroup_t directories.
[WIP-need bug investigation] Don't audit syslog-ng chowning of unallocated ttys

When syslog-ng sends logs to a tty, for example with such a config:

    source src { system(); };
    destination console_all {
        file("/dev/tty12" owner(-1) group(-1) perm(-1));
    };
    log { source(src); destination(console_all); };

... it calls fchown to set the tty owner to root.  Gentoo already
dontaudit this access so generalize this to all distributions.

Additional notes

Here is audit.log:

    type=AVC msg=audit(1406664197.616:213): avc:  denied  { setattr } for  pid=603 comm="syslog-ng" name="tty12" dev="devtmpfs" ino=1053 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tty_device_t tclass=chr_file
    type=SYSCALL msg=audit(1406664197.616:213): arch=c000003e syscall=93 success=yes exit=0 a0=e a1=0 a2=ffffffff a3=7fff1af449cc items=0 ppid=1 pid=603 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="syslog-ng" exe="/usr/bin/syslog-ng" subj=system_u:system_r:syslogd_t key=(null)
    type=PROCTITLE msg=audit(1406664197.616:213): proctitle=2F7573722F62696E2F7379736C6F672D6E67002D46

Translation of audit.log messages:
    * syscall 93 on x86_64 = "fchown"
    * parameters: (int fd=0xe, uid_t owner=0, gid_t group=-1)
    * /proc/603/fd/11 = /dev/tty12 (inode 1053 of my /dev)

Example of syslog-ng.conf on Gentoo:
http://www.gentoo.org/doc/en/security/security-handbook.xml?part=1&chap=3#doc_chap4
Label systemd files in init module
Label systemd-cryptsetup as lvm_exec_t
Add systemd service access vectors

The new "service" class controls interaction with service units.
Label systemd-journald files and directories
Support logging with /run/systemd/journal/dev-log

In June 2014 systemd moved the socket used by journald to /run.  This
requires two new directory search access for every domain sending syslog
messages:

* /run/systemd/ (handled by init_search_pid_dirs)
* /run/systemd/journal/ (labeled syslogd_var_run_t)

systemd commit:
http://cgit.freedesktop.org/systemd/systemd/commit/units/systemd-journald-dev-log.socket?id=03ee5c38cb0da193dd08733fb4c0c2809cee6a99
Label /dev/log symlink at boot time with systemd

systemd creates /dev/log as a symlink to /run/systemd/journal/dev-log
when staring the Journal Socket Unit.  Add an interface to logging
module to label this symlink correctly.

Please note this is distinct from what Fedora does in its policy:
https://git.fedorahosted.org/cgit/selinux-policy.git/tree/policy/modules/system/logging.if?h=rawhide-base&id=f85b52d1c6805e9b0a8bd2a4a4332e66e4b52c00#n611

Here is the unit file responsible for creating the symlink:
http://cgit.freedesktop.org/systemd/systemd/tree/units/systemd-journald-dev-log.socket?id=v215
Allow journald to read the kernel ring buffer and to use /dev/kmsg

journald uses RW access to /dev/kmsg [1].  It also needs to read the
kernel read buffer:

    avc:  denied  { syslog_read } for  pid=147 comm="systemd-journal" scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1

[1] http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/journald-kmsg.c?id=v215#n394
Label config files of systemd-hostnamed as hostname_etc_t

systemd-hostnamed uses /etc/hostname and /etc/machine-info to retrieve
information about the current host and modify it.

In Fedora's policy these labels are in the systemd module.  However
/etc/hostname is not a systemd-specific file and hence should be labeled
outside of the systemd module.

More information about the files can be found here:

* http://www.freedesktop.org/software/systemd/man/hostname.html
* http://www.freedesktop.org/software/systemd/man/machine-info.html
* http://www.freedesktop.org/software/systemd/man/systemd-hostnamed.service.html
[FIXME] Add systemd access vectors

systemd uses new "system" access vectors to filter access to halt/reboot
commands and to system status (for example when listing units).

Upstream refuses these new AV:
http://oss.tresys.com/pipermail/refpolicy/2014-July/007237.html
[REVIEW REQUIRED] Introduce *_inherited_*_perm permission sets

These permission sets allow specifing permissions on file inherited file
description, where open() is denied.  They are needed by systemd policy