nastyness

rpm needs to manage sec_files and auth_files but they arent covered by file_unconfined()
which by the way associates the callers role with all file_type_except
i need to explicitly associate the role of whoever manages sec and auth files with the type

theres also voodoo going on with ldconfig, seems rpm installs a symlink (bin:2324) which ended up rootfs
allowing rpm to create symlinks in / with bin type

systemd also wants to relabelfrom run