initial bootloader
    make rpm script run grubby and akmods with a domain transition
    we may not be able to confine rpm script but we can confine
    grubby and akmods
bootloader: add conf file object
    /boot/efi/EFI/fedora/grub.cfg is dosfs_t
add domain for privileged grub tools
allow unconfined subjects to create grub config file objects with a name-based file object type transition
add more grub config file objects
exceptions:
    1: is_all_files_exception is there to make shadow_t and policy_conf_t
        an exception to all files

    has_unconfined_access_to_files_assets has unconfined access to all files except
    shadow_t, and policy_conf_t

    2. taking the above in account, any all_non_auth_files_except means that it
        excludes is_all_files_exception (shadown_t and policy_conf_t currently),
        plus any possible is_all_non_auth_files_exception (currently none)

    there cannot be a "files_manage_all_non_auth_files" for example because it
    always also excludes any is_all_files_exception asociated types, and so it is
    always "files_manage_all_non_auth_files"

    3. the files_spec_all_non_auth_files_except() is all_non_auth_files minus
        is_all_files_exception, and any specified exceptions

    this means that is_all_non_auth_files_exception is not included with
    files_spec_all_non_auth_files_except
seutil: add files_relabel_all_except()
    was seeing denials on auth files like auditd_conf_t
systemd: created /dev/initctl symlink
systemd: reads binfmt_misc
systemd: lists "debug"