i think you need CAP_SYS_ADMIN which is a little coarse-grained for my taste CAPTAIN SYS ADMIN HE FIGHTS CRIME