rework policy code
add fgetattr. closes #5