Making sure that the stdout redirection is happening *inside* the worker

Otherwise idia_restricted_t would require access to idia_service_t's
file descriptors, which would ruin the SELinux policy