allow rmt_storage self:capability sys_admin;