pf plugin: read permissions are enough for /dev/pf