Fix SELinux policy for sandbox X server to fix 'sandbox -X' command

[krishjainx]

Hi,

Hope you're well! I was speaking with @rhatdan and trying to make "sandbox -X" work properly. This issue occurs on Rawhide. The error I get is:

/usr/share/sandbox/sandboxX.sh: line 16: 810257 Aborted                 (core dumped) /usr/bin/Xwayland -terminate -dpi $DPI -retro -geometry $SCREENSIZE -decorate -displayfd 5 5>&1 2> /dev/null

I ran it with setenforce 0 and it worked then. The AVC I saw immediately in the problematic run was:

type=AVC msg=audit(1721850176.924:703): avc: denied { search } for pid=30127 comm="Xwayland" name="dev" dev="proc" ino=24178 scontext=unconfined_u:unconfined_r:sandbox_xserver_t:s0:c149,c693 tcontext=system_u:object_r:sysctl_dev_t:s0 tclass=dir permissive=0

Dan says there's no problem allowing that, and that he's sure there are plenty more.

I've spoken with Dan, Lukas, Zdeněk, and Petr, and Dan suggested this implementation.

Not tested yet.

[zpytela]

@krishjainx The content LGTM now. Would you just mind squashing the commits into 1 and add a commit message explaining (one or two sentences) what or why you are doing?

[krishjainx]

Done

[zpytela]

LGTM

[zpytela]

Merging, thank you.