Various
    /sys/fs/cgroup is type tmpfs_t
        so allow subjects reading cgroup files to search tmpfs_t dirs
    subjects maintaining user fonts cache files need to be able to fall back
    to ~/.fontconfig