allow vendor_dpmd self:capability sys_admin;