allow system_server self:capability sys_module;