firstboot is leaking a netlink_route socket into iptables.  We need to dontaudit
    tmpfs_t/devpts_t files can be stored on device_t file system
    unconfined_mono_t can pass file descriptors to chrome_sandbox, so need transition from all unoconfined users types
    Hald can connect to user processes over streams
    xdm_t now changes the brightness level on the system
    mdadm needs to manage hugetlbfs filesystems