cap-bs-keep CAP_NET_ADMIN,CAP_DAC_OVERRIDE,CAP_NET_RAW,CAP_NET_BIND_SERVICE,CAP_SETGID,CAP_SETUID,CAP_SYS_MODULE,CAP_AUDIT_WRITE,CAP_KILL,CAP_SYS_CHROOT
ro-sys
ro-home
hardlimit
