type:EXECVE a0:getcap a1:\-r a2:\/