[v2] refpolicy: run setfiles only if $D is set