/sbin/lidsconf -A -s /bin/su -o /etc/shadow -j READONLY /sbin/lidsconf -A -s /bin/su -o CAP_SETUID -j GRANT /sbin/lidsconf -A -s /bin/su -o CAP_SETGID -j GRANT