Should file permissions match SELinux policy?