SELinux: check open perms in dentry_open not inode_permission