role template: these role template are called not only by users
and we want only users to have these permissions
exceptions:
    systemd needs to relabel a lot, readahead meeds to read alot
    implement the same solution as i did for tmpfiles where
    specified content can be easily excluded.

    exclude user content from being systemd relabelable
    exclude user content from being readahead readable

    this policy is for my laptop and so user content has
    high priority with regard to enforcement of integrity
ip: iwconfig requests net_admin capability
various
initial efiboot -> searches efivarfs
systemd traverse ~/{.config,.local} -> this is a temporary hack
readahead reads /root/.bashrc -> dontaudit
update TODO
miscfiles: read generic cert clients read symlinks