allow per_mgr self:capability net_raw;