the "readwrite.subj_type" macros arent always called in the right container (review them all)
mmc, sr, and fd (floppy) are really removable.stordev (move them back to removablestordev.cil)

opkg LuCI
chronyd LuCI/initscript
sysupgrade LuCI
unbound LuCI/initscript
wireguard LuCI
zram LuCI/initscript
acme (standalone, dns)
logread (remote logging)

shadow --with-selinux

tftp
lvm2
