Constant CAPABILITIES 

pub const CAPABILITIES: [&'static str; 1];

The Capability enum, which is exactly this one value.

Which is why guest identity repair is a boolean intent flag rather than a capability list (TRAP-3): there is no way to ask for CAP_SYS_ADMIN alone.