Allow udev_t domain to read files labeled as consolekit_var_run_t

When the active session is changed, the udev-acl executable is called
by ConsoleKit. It will then read the ConsoleKit database to figure out
which is the active one.

policy/modules/system/udev.te

@@ -220,6 +220,10 @@ optional_policy(`
 	consoletype_exec(udev_t)
 ')
 
+optional_policy(`
+	consolekit_read_pid_files(udev_t)
+')
+
 optional_policy(`
 	cups_domtrans_config(udev_t)
 ')