rootwrap filters to allow calls to xenon-ctl