allow servicemanager per_mgr:dir search;
allow servicemanager per_mgr:file { open read };
allow servicemanager per_mgr:process getattr;