systemd weirdness
    sys (systemd in the kernel) prefers auto over dynamic subtrans

    if sys is unconfined then it wants to auto transition to systemd else
    dynamic transtion is sufficient
Three systemd daemon blockabstracts
    differentiate between daemons without units, with units, and socket activated daemons

    The problem with socket activated daemons is that we can't know where the socket lives beforehand

    In practice, sometimes it is in /run and sometimes it is is /var/lib. So if you are using the systemd_daemon_socket_activated
    blockabstract then it is your own responsibility to additionally call systemd_daemon_socket_activated_object_type()
Add in app.cil
lib.cil is optional in theory
    in practice, though, you might want to enclose it

    depending on how, or whether, i deal with neverallow on execmod it may not forever be optional