allow netmgrd self:capability dac_override;
allow netmgrd unlabeled:file { getattr open read };