trying to deal with ~/.config/systemd

associate firewall unit with firewall object (firewalladm was not able to access the firewalld unit file)
common/priv login users can run systemctl, and run askpwdagent with a subtrans
I was hitting issues
    really need the config home type for ~/.config
could not access /run/user/$UID
common/priv login subject can execute journal to see user logs
gpasswd is in /usr/bin not /usr/sbin
systemd reads .config/systemd
common login users can read generic etc and usr

I suppose anyone with access to systemctl should be able to list units and reload units (but dont do this now because it doesnt work anyway)

the systemd session daemon runs with the systemd system credentials

if confined users were to be allowed to start session units then those processes would end up with excessive privileges

we need to be able to to tell logind that the systemd session daemon needs to run with the calling users selinux creds instead of the systems selinux creds