In the future, this will likely include an ostree_t domain. For now, this is just a few additional allow rules.