Overwrite file_contexts.homedirs and genuserfc_template because you need
to "loadpolicy" manually anyway which will take care if it
Handle unknown=deny

Check for never allow violations (i thought -N would enable the check
but turns out that disables it)
Label / root_t
Remove genuserfc.bash
loadpolicy: does not yet support %group entries in
/etc/selinux/$SELINUXTYPE/seusers