Seen in policy-20081111.patch:
grep -n wm policy* | grep ' :x_draw'
policy-20081111.patch:3763:+allow wm_t :x_drawable { get_property setattr show receive
manage send read getattr list_child set_property };
Am I senile, or is something missing before that ":"?
(Don't ask how I found it, 'tis a long and sordid tale.. I may be posting
about the original issue separately).