allow wcnss_service self:capability { setgid setuid };