Allow apexd to flush block devices.

To work around a kernel bug where pages that are read before changing
the loop device offset are not invalidated correctly.

Bug: 120853401
Test: apexd mounts APEX files on gphone_sdk_x86_64
Change-Id: I89f23f8f9d472e599f053553b73cc0618dcb3747

private/apexd.te

@@ -21,6 +21,7 @@ allowxperm apexd loop_device:blk_file ioctl {
   LOOP_SET_BLOCK_SIZE
   LOOP_SET_DIRECT_IO
   LOOP_CLR_FD
+  BLKFLSBUF
 };
 # allow apexd to access /dev/block
 allow apexd block_device:dir r_dir_perms;