allow zygote self:process execmem;
allow zygote self:capability sys_nice;