[SuperR Kitchen] Captain_Throwback:
[MENTION=5787964]SuperR.[/MENTION]

The additional metadata lines seemed to have no ill effect, and I think it's better to include them rather than not since they have specific contexts defined. The "standard" permissions for /system/bin appear to work fine for them. So, here's a list of the additional set_metadata lines for my A9 ROM. If you could add these to the kitchen, I'd greatly appreciate it :):

set_metadata("/system/bin/Wifilogger_app", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:wcnss_service_exec:s0");
set_metadata("/system/bin/clockd", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:clockd_exec:s0");
set_metadata("/system/bin/debuggerd64", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:debuggerd_exec:s0");
set_metadata("/system/bin/dmagent", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:dmagent_exec:s0");
set_metadata("/system/bin/fingerprintd", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:fingerprintd_exec:s0");
set_metadata("/system/bin/fp_img_encrypt", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:fingerprintd_exec:s0");
set_metadata("/system/bin/hcheck-v2", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:wv-prov_exec:s0");
set_metadata("/system/bin/htc_ebdlogd", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:htc_ebdlogd_exec:s0");
set_metadata("/system/bin/htcpreloader", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:ssd_tool_exec:s0");
set_metadata("/system/bin/htcserviced", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:ssd_tool_exec:s0");
set_metadata("/system/bin/hvdcp_opti", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:hvdcp_exec:s0");
set_metadata("/system/bin/ipacm", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:ipacm_exec:s0");
set_metadata("/system/bin/ipacm-diag", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:ipacm-diag_exec:s0");
set_metadata("/system/bin/lowi-server", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:location_exec:s0");
set_metadata("/system/bin/memlock", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:memlock_exec:s0");
set_metadata("/system/bin/pm-proxy", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:per_mgr_exec:s0");
set_metadata("/system/bin/qfipsverify", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:sectest_exec:s0");
set_metadata("/system/bin/qmi-framework-tests/qmi_test_mt_client_init_instance", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:qmi_test_service_exec:s0");
set_metadata("/system/bin/tbaseLoader", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:tbaseLoader_exec:s0");
set_metadata("/system/bin/tftp_server", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:rfs_access_exec:s0");
set_metadata("/system/bin/thermal-monitor", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:thermal-monitor_exec:s0");
set_metadata("/system/bin/tpd_daemon", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:tpd_daemon_exec:s0");
set_metadata("/system/vendor/bin/mm-pp-daemon", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:mm-pp-daemon_exec:s0");
set_metadata("/system/vendor/bin/perfd", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:perfd_exec:s0");
set_metadata("/system/vendor/bin/qti", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:qti_exec:s0");
set_metadata("/system/vendor/bin/slim_daemon", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:location_exec:s0");
set_metadata("/system/xbin/su", "uid", 0, "gid", 0, "mode", 06755, "capabilities", 0x0, "selabel", "u:object_r:su_exec:s0");

(I know the "su" metadata line is weird, but I often build ROMs from test devices which have a prebuilt su binary in system/xbin, which requires its own context)

I also have some supplementary lines for the M8 - the Sense version of the ROM for Sprint includes some permissions/contexts that the GPE/GSM version doesn't. They probably won't apply for most devices, but probably better to have them than not:

set_metadata("/system/bin/htcbarocal_csd", "uid", 0, "gid", 1000, "mode", 0750, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/bin/ip6tables", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:nettools_exec:s0");
set_metadata("/system/bin/isdbtmmtest", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:sectest_exec:s0");
set_metadata("/system/bin/qseecom_security_test", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:sectest_exec:s0");
set_metadata_recursive("/system/vendor/itson", "uid", 1500, "gid", 0, "dmode", 0755, "fmode", 0440, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/vendor/itson", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/vendor/itson/itson-bootstrapper.sh", "uid", 1500, "gid", 0, "mode", 0550, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/vendor/itson/itson_installer", "uid", 1500, "gid", 0, "mode", 0550, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/xbin/dexdump", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");

(I saw you had a line for system/vendor/itson in your default metadata file, but the uid is different and for some reason my script has an extra line there)

I think some of my devices' system/vendor/bin lines match up to your vendor/bin lines, because on HTC devices the files in /system/vendor are symlinked to /vendor. But the permission/context for them has to be set where they actually are during the flash. Not sure if there's an easy way for you to combine those based on location, or just have separate lines for the same files.