dontaudit odrefresh self:capability { kill sys_admin };