case "${ACTION}" in post) chgrp wireshark usr/bin/dumpcap setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' usr/bin/dumpcap ;; esac