Allow apps to execute the shell or system commands unconditionally.

Change-Id: I54af993bd478d6b8d0462d43950bb1a991131c82
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

app.te

@@ -132,6 +132,10 @@ allow appdomain platform_app_data_file:file { getattr read write };
 allow appdomain system_data_file:dir r_dir_perms;
 allow appdomain system_data_file:file { execute open };
 
+# Execute the shell or other system executables.
+allow appdomain shell_exec:file rx_file_perms;
+allow appdomain system_file:file rx_file_perms;
+
 # Read/write wallpaper file (opened by system).
 allow appdomain wallpaper_file:file { read write };
 

cts.te

@@ -23,10 +23,6 @@ allow appdomain file_type:dir_file_class_set getattr;
 allow appdomain dev_type:dir_file_class_set getattr;
 allow appdomain fs_type:dir_file_class_set getattr;
 
-# Execute the shell or other system executables.
-allow appdomain shell_exec:file rx_file_perms;
-allow appdomain system_file:file rx_file_perms;
-
 # Accesses to apk_tmp_file and shell_data_file
 allow appdomain apk_tmp_file:file rw_file_perms;
 allow appdomain shell_data_file:file r_file_perms;