allow mediaprovider_app rootfs:dir { read };
allow mediaprovider_app rootfs:file { getattr };