allow fsck self:capability { sys_admin kill };
dontaudit fsck self:capability { dac_override dac_read_search };