systemctl: manage all service and system
session: some rules a confined privileged session domain should probably have
miscfiles: start implemementing terminfo
initial nettools
    without "user_ping"
nettools: make arp application subject
initial consoletype
initial dmesg
terminfo: add in some terminfo calls
Various
    make /usr/local/s?bin equivalent to /usr/s?bin
    initial sensors
    confine ausearch
    user subject needs to be able to send child terminated signal and
    use file descriptors or programs that run binaries as the calling user subject
    (may also needs to be able to read/write inherited unnamed pipes)
remove entry from to do list
pinentry also reads terminfo files