pub fn capability_matches_resource_pattern( cap: &CapabilityToken, pattern: &str, ) -> Result<bool, KernelError>