Allow fapolicyd watch directories

New watch permissions have been introduced into selinux-policy
with the following PR:
fedora-selinux/selinux-policy#546

The fapolicyd daemon needs watch_mount and watch_with_perm permissions
for fanotify/inotify/dnotify calls on the following directories:
- root directory
- tmpfs directories
- tmp and user tmp directories

Author: zpytela

fapolicyd.te

@@ -61,11 +61,21 @@ domain_read_all_domains_state(fapolicyd_t)
 
 files_mmap_usr_files(fapolicyd_t)
 files_read_all_files(fapolicyd_t)
+files_watch_mount_generic_tmp_dirs(fapolicyd_t)
+files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
+files_watch_mount_root_dirs(fapolicyd_t)
+files_watch_with_perm_root_dirs(fapolicyd_t)
+
 fs_getattr_xattr_fs(fapolicyd_t)
+fs_watch_mount_tmpfs_dirs(fapolicyd_t)
+fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
 
 logging_send_syslog_msg(fapolicyd_t)
 dbus_system_bus_client(fapolicyd_t)
 
+userdom_watch_mount_tmp_dirs(fapolicyd_t)
+userdom_watch_with_perm_tmp_dirs(fapolicyd_t)
+
 optional_policy(`
         rpm_read_db(fapolicyd_t)
         allow fapolicyd_t rpm_var_lib_t:file { create };