rpm/session: what a f*cking mess this is
    session_t must be associated with system_r, just for f*cking rpm
    session_t needs to be able to change to system, just for f*cking rpm
    session_r needs roleallow and roletrans system_r, just for ...