allow kernel vendor_file:file r_file_perms;

dontaudit kernel self:capability { dac_override dac_read_search };