mocp:
    can traverse all session home
    can list home dir
    can list home content
    can manage moc home config
    can read generic home content
    dontaudit all else
ssh: might be a bit too early for this
this allows modules to create their own "foo managable, readable, relabable file object" macros

i created one example

tmpfiles needs to be able to manage and relabel a lot of places, one conceivable exception for just tmpfiles would be
for example is_session_home_file_objects, besides the usual not_associated_with_authentication_file_objects.

this allows me to exclude just that for tmpfiles without getting into dependency trouble (i hope)

the solution looks weird for thsse that are familiar with refpolicy