various
    autorelabel actually opens /dev/console
    systemctl needs net_admin (or doesn't need it but at least requests it)
    shutdown read /dev/urandom