RBAC policy for tcpdump