allow priv_app device:dir { read open };