Layout improvement
Implement unconfined_execmod boolean
If you arent either domain or invalid_t then you arent a process
We need the ldconfig domain for privileged processes
Deal with mislabeled /sys/fs/cgroup
Fix bad /lib /lib64 symlink context specs