improve comments & validation, use Constant…

…instead of method, use defaultfor for confinement
generate and write udev rules

currently this is still failing in some scenarios:
if storage.config has been properly updated, but the udev rules were
not, self.post_flush will not run at all

also there's the mysterious case of: how do i access the
owner/group/target from within the provider (class)?

do i have to put it in at instance level, while prefetching?