update TODO:
    these are shell scripts that only run kmod (modprobe)
    kmod is already a systemd oneshot
update todo
    this is also a shell script that does not do much
initial notify
    is called from a readahead service unit
    but its a wrapper around sd-notify() intended to be used by
    shell scripts to notify init
cron: remove unconfined_subject(system_cronjob_t)
systemd_daemon/cron
    remove unconfined_subject(systemd_daemon_t)
    kmod_exec(systemd_daemon_t is for lm_sensors
    commands_execute_bin_files(systemd_daemon_t) is for dracut restore initramfs
various
    remove permissivetypes
    initial dracut for dracut initramfs restore shell script
    confine lm sensors wrapper shell script because they run kmod
    rules related to removing unconfined_subject() calls in cron and systemd