This was first done in b13eb3f because magiskd was started in
post-fs stage that time. Among all android versions, logd was all
started before post-fs-data.
Before magiskd is executed, all files in magisk tmpfs still shares
tmpfs label. This commit tightens the rule to only allow init, zygote
and shell to access magisk tmpfs files. Zygotes rules is needed
because lower Android versions don't have rule for zygote itself
using memfd even memfd is supported in kernel.
This fixes device credential confirm activity on OnePlus devices
because SuRequestActivity is accidentally finished before a valid
response is delivered to it.
