allow CAP REQ -capability-name