allow mediaserver unlabeled:file { getattr open read };