add policycoreutils and related tools

[bcressey]

Issue number:
#997

Description of changes:
Add policycoreutils to the default install, so that higher level tools for managing the policy are available if the break-glass admin container is used. In particular, semodule is useful for making temporary adjustments to troubleshoot an issue.

The policy files are now included in the image, as otherwise it is not possible to extend the policy without obtaining them from the repository.

Adjust the kernel default for memory protection checking so that sestatus reports "actual (secure)". We don't enforce the memory protection checks for processes running inside containers, and none of the host binaries request memory that's both writable and executable, so this is not a fixing an actual vulnerability, just hardening the default.

Testing done:
Built the aws-dev variant. Confirmed that the policy was loaded and that files copied by tmpfiles.d were correctly labeled.

Built the aws-k8s-1.17 variant. Verified that conformance tests passed with no AVC denials.

Tested various semodule commands: -R reloads the policy and -B builds and reloads the policy.

Verified that a new policy module that refers to existing policy types can be created and loaded:

# cat <<EOF >/tmp/permissive.cil
(typepermissive super_t)
EOF
# semodule -i /tmp/permissive.cil
# echo -n 'system_u:system_r:system_t:s0' > /proc/self/attr/current
# dmesg
[...] audit: type=1400 audit(1596900137.247:11): avc:  denied  { dyntransition } for  pid=570238 comm="bash" scontext=system_u:system_r:super_t:s0 tcontext=system_u:system_r:system_t:s0 tclass=process permissive=1

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.