cifs_restricted in OUTPUT chain