SELinux: check OPEN on truncate calls