cm: Fix a few denials

* Missed a few things when cleaning up devices.

Change-Id: Ib71afd696a564aeeaa80c34ca9744a39891f4b63

sepolicy/qcom/bootanim.te

@@ -1,3 +1,8 @@
 allow bootanim mpctl_socket:dir search;
 unix_socket_connect(bootanim, mpctl, perfd)
 unix_socket_send(bootanim, mpctl, perfd)
+
+allow bootanim mpdecision:dir search;
+allow bootanim mpdecision:file r_file_perms;
+unix_socket_connect(bootanim, mpctl, mpdecision)
+unix_socket_send(bootanim, mpctl, mpdecision)

sepolicy/qcom/mpdecision.te

@@ -0,0 +1,5 @@
+allow mpdecision sysfs_devices_system_iosched:file rw_file_perms;
+unix_socket_connect(mpdecision, thermal, thermal-engine)
+
+# read /proc/pid files
+r_dir_file(mpdecision, domain)

sepolicy/zygote.te

@@ -1,3 +1,5 @@
 allow zygote theme_data_file:file r_file_perms;
 allow zygote theme_data_file:dir r_dir_perms;
 
+# ps command may do this
+allow untrusted_app zygote:process getsched;