Fix denials triggered by adb shell screencap.

Change-Id: Ief925f1f49a6579d5a7a1035f3732834238fa590
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

dumpstate.te

@@ -71,5 +71,5 @@ allow dumpstate self:capability sys_ptrace;
 
 # Allow the bugreport service to create a file in
 # /data/data/com.android.shell/files/bugreports/bugreport
-allow dumpstate shell_data_file:dir rw_dir_perms;
+allow dumpstate shell_data_file:dir create_dir_perms;
 allow dumpstate shell_data_file:file create_file_perms;

surfaceflinger.te

@@ -42,4 +42,5 @@ allow surfaceflinger bootanim:fd use;
 
 # Allow a dumpstate triggered screenshot
 binder_call(surfaceflinger, dumpstate)
+binder_call(surfaceflinger, shell)
 allow surfaceflinger shell_data_file:file write;