#============= per_mgr ==============
allow per_mgr self:capability { dac_override net_raw };