devices: this was giving common domains access to read device_t symlinks