allow vdc vdc:capability { sys_admin kill };