We need CAP_NET_ADMIN which really needs to be broken down further.