this is to deal with xserver shm once and for all
gdm needs to stream connect to gkeyringd but unconfined does not run that with a type transition
also the sock file needs to be labeled so that we can limit the sock files gdm can write

this labels $XDG_RUNTIME_DIR/keyring with a private type, even for unconfined