aa_capable
int aa_capable(const struct cred *subj_cred, struct aa_label *label,
error = aa_capable(cred, label, cap, opts);
err = aa_capable(subj_cred, label, cap, CAP_OPT_NONE);
aa_capable(subj_cred, label, CAP_SYS_RESOURCE, CAP_OPT_NOAUDIT) != 0)
ad->error = aa_capable(cred, &tracer->label, CAP_SYS_PTRACE,