Also rewrite to use positive permission sets, macros, and
eliminate duplication.

Change-Id: I4dc340784f770e569160025a5db2dc3da90d2629
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>