add bluetooth
admins of individual services can execute systemctl, are systemctl_client_subject_type
and can reload services and daemon (these are needed to enable/disable a service)
this is more efficient, since compiler will drop duplicate rules
add cups
update TODO