# OTA with encrypted f2fs
allow uncrypt self:capability sys_admin;