Merge changes If2413c30,Ic5d7c961

* changes:
  Suppress spurious denial
  Suppress spurious denial

private/netutils_wrapper.te

@@ -33,3 +33,9 @@ domain_auto_trans({
     -coredomain
     -appdomain
 }, netutils_wrapper_exec, netutils_wrapper)
+
+# suppress spurious denials
+dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
+
+# netutils wrapper may only use the following capabilities.
+neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };

private/zygote.te

@@ -114,6 +114,9 @@ allow zygote tmpfs:dir r_dir_perms;
 get_prop(zygote, overlay_prop)
 get_prop(zygote, exported_overlay_prop)
 
+# ingore spurious denials
+dontaudit zygote self:capability sys_resource;
+
 ###
 ### neverallow rules
 ###