we will rely on role-based compartmentalization
except for signal, anyone running anything can send generic signal
add dconf
make dconfsvc dconf_client()
tie some loose ends
forgot /usr/bin/dconf