[WIP] sepolicy: fix a few denials

* rebootcmd is going to be a pita...

Change-Id: I9e34b2c78416464fa80e2c2000d9f5b5aabec645