gdm stream connects to unconfinedusers gkeyringd, and reads gnome-shells state
add rtkit
add udisks
add readahead
fixes
user.user_tmpfs_object is not a mountpoint ($XDG_RUNTIME_DIR/gvfs
more "fixes"
some kdump, had to since udevd starts kdump.service
importstate is trying to be smart by running cp with -Z...
ofcourse that is all wrong and now i am forced to dontaudit
fixes
this is required for at least gnome accessibility daemon (starts its own bus)
I thought i would be using setfscreatecon, this is for /dev/lp.*
import state runs restorecon and this seems related
add some permissives
fixes
seems gdm hangs waiting for plymouth screen to finish?
gdm should be ok now, but seems xserver or xserver_wrap is missing something
if you run xserver or xserver_wrap with a domain transition then you must siginh as well
shutdown hell:
it needs to be able to copy /usr/sbin/kexec to /run/initramfs/.*
it needs to be able to read initramfs run lnk files
it needs to execute the mdadm-shutdown script (which runs mdadm)

TODO:
i need to confine mdadm, allow shutdown to execute it and then allow shutdown to read /run/mdadm