[Nexus 6  General] slifox0:
I've made good progress modifying phhusson's install-su.sh script to allow certain activities, without using permissive mode. As mentioned before, my main goals are AFWall+ (excellent opensource iptables firewall app) and ad blocking (via hosts file). Both are now working without permissive mode! :D

My method for figuring out these rules involved a lot of reboots... too many. Is there some way to set selinux to allow-but-log everything? That would make this "rule training" process so much faster

Here are the current rules I've added. I tried to keep these as tight as possible, but there might be a bit extra that's not needed. Basically I just allowed anything that alerted when running the command in the comment. I did this in order, so some of the later commands actually depend on permissions defined in the earlier ones (i.e. the bind mount depends on access to /sdcard/ to read /sdcard/hosts).

# Boot
allow init su_daemon process "siginh rlimitinh noatsecure"
allow su dalvikcache_data_file dir "write add_name remove_name"
allow su dalvikcache_data_file file "write create unlink"
allow su su capability "sys_nice dac_override"
allow system_server su binder "call"

# Superuser.apk granting access to AFWall+ (but this doesn't always show up! not sure what's going on...)
allow su su unix_stream_socket "write"
allow su_daemon su_daemon process "signal"
allow su_daemon su_daemon unix_stream_socket "connect"

# adb shell; su (and manual use of /data/local/tmp)
allow su shell_data_file dir "read write search getattr open add_name remove_name create unlink"
allow su shell_data_file file "read write getattr open create unlink"

# adb shell; su; ps
allow su init dir "getattr search"
allow su kernel dir "getattr search"
allow su init file "read open"
allow su kernel file "read open"

# adb shell; su; ls /sdcard/
allow su storage_file dir "search"
allow su storage_file lnk_file "read"
allow su mnt_user_file dir "search"
allow su mnt_user_file lnk_file "read"
allow su fuse dir "search read open getattr"
allow su fuse file "read open getattr ioctl"

# AFWall+
allow su untrusted_app fifo_file "ioctl getattr"
allow su app_data_file dir "search getattr"
allow su app_data_file file "getattr execute read open execute_no_trans"
allow su system_file file "execute_no_trans"
allow su su unix_stream_socket "bind"
allow su su rawip_socket "create getopt setopt ioctl"
allow su su udp_socket "create getopt setopt ioctl"
allow su su tcp_socket "create getopt setopt ioctl"
allow su su capability "net_raw net_admin"

# mount -o /sdcard/hosts /system/etc/hosts
allow su system_file file "mounton"
allow su su capability "sys_admin"
allow su shell_data_file file "ioctl"
# umount /system/etc/hosts
allow su labeledfs filesystem "unmount"
allow su block_device dir "search"

# remount -o remount,rw /system
allow su labeledfs filesystem "remount"

# init.rc: service hosts_file /system/bin/mount -o bind /sdcard/hosts /system/etc/hosts (copied from "ls /sdcard/" and "mount -o..." above -- these may be a bit overly broad for the init.rc purpose)
allow toolbox storage_file dir "search"
allow toolbox storage_file lnk_file "read"
allow toolbox mnt_user_file dir "search"
allow toolbox mnt_user_file lnk_file "read"
allow toolbox fuse dir "search read open getattr"
allow toolbox fuse file "read open getattr ioctl"
allow toolbox system_file file "mounton"
allow toolbox toolbox capability "sys_admin"
allow toolbox shell_data_file file "ioctl"
# init.rc mount hosts from /data/local/tmp/hosts (because sdcard is not working yet)
allow toolbox shell_data_file dir "read write search getattr open add_name remove_name create unlink"
allow toolbox shell_data_file file "read write getattr open create unlink ioctl"

I got /system/etc/hosts bind mount to work on boot, but only from /data/local/tmp/hosts (could change this to another /data dir easily). Here's my service:

service hosts_file /system/bin/mount -o bind /data/local/tmp/hosts /system/etc/hosts
user root
class late_start
oneshot

However I haven't gotten it to mount on boot from /sdcard/hosts, because I can't find a way to start the init.rc service after /sdcard has been mounted.