allow /tmp/pqp/** r,
