- Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK)
    - Make corosync to be able to relabelto cluster lib fies
    - Allow samba domains to search /var/run/nmbd
    - Allow dirsrv to use pam
    - Allow thumb to call getuid
    - chrome less likely to get mmap_zero bug so removing dontaudit
    - gimp help-browser has built in javascript
    - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t
    - Re-write glance policy