# watchdog needs this
allow kernel self:capability sys_admin;