allow rfs_access self:capability net_raw;
allow rfs_access unlabeled:file { getattr open read };