before: /dev/md0 only
after ./md_grow (opens md0): /dev/md0 /dev/md0s0 /dev/md1 /dev/md1s0   <- auto-created
operator-group user (testuser, groups=wheel,operator):
  dd: /dev/md0: Operation not permitted   (x3)  <- RESTRICTEDROOT gate
root: dd if=/dev/md1 ...: 1+0 records in, 1+0 records out