* named by @user@; otherwise, the user string is @user@ itself.
* The user string consists of a sequence of capability
* defintiions separated by colons. Each definition has the
* named by @user@; otherwise, the user string is @user@ itself.
* The user string consists of a sequence of capability
* defintiions separated by colons. Each definition has the