sepolicy: Fix a few denials

 * Zygote needs to set system properties
 * Installd needs to rename files

Change-Id: Ic570830cb4fcc3c0806ae775b9258350d2c90d24
Add a domain for the recovery console.

Define a domain for use by the recovery init.rc file for
/sbin/recovery.  Start with a copy of the kernel domain
rules since that is what /sbin/recovery was previously running in,
and then add rules as appropriate.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Allow recovery to execute ashmem_device and tmpfs.

Requires execmem and ashmem_device:chr_file execute similar to bootanim
presumably for the display.

Did not see any cache_file execute denials and do not see any
exec of /cache files in the code, only reading/interpreting scripts,
so I removed cache_file rx_file_perms.

Did not see any tmpfs execute denials in /proc/last_kmsg but the
source code appears to extract the update-binary to a tmpfs mount
in /tmp and then exec it.  So I retained that rule.

Tested with adb sideload.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

ashmem_device is a character device, not a regular file.

Change-Id: I9b9ac1a383ac2ffdaf2fc62cb11ed026505ed924
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>