add capabilities to apparmor startup block