refpolicy: run setfiles only if $D is set