Update TODO
systemd: writes /etc /var /sys (not sure if access check or not)
    these seem to be actually generators that arent covered yet
    so after i covered all common generators i might want to review these
tmpfiles: factory reset related
jounrald: in case users runs journalctl as session_t in ~
session: lspci seems to need sys_admin
    this my have been triggered by bug ( seems that something
    runs (sudo?) lspci on behalf of the user)

    however, since session_t is privileged domain, and roughly the
    equivalent of sysadm_t i suppose sooner or later i would have
    permitted this