CAP_SYSLOG
if (security_capable(cred, &init_user_ns, CAP_SYSLOG,
if (capable(CAP_SYSLOG))
if (!has_capability_noaudit(current, CAP_SYSLOG) ||
#ifndef CAP_SYSLOG
bool cap_syslog = perf_cap__capable(CAP_SYSLOG, &used_root);