Which of the following capabilities are you allowed to add to a container using the Restricted policy?

The `CHOWN` capability allows changing file ownership, which is considered a privileged operation and is typically disallowed by a `Restricted` Pod Security policy to prevent unauthorized filesystem modifications.

The `SYS_CHROOT` capability allows performing a `chroot` operation, which is a highly privileged action that can be exploited for container escapes and is therefore disallowed by a `Restricted` Pod Security policy.

The `SETUID` capability allows setting arbitrary user IDs, which can be used for privilege escalation within a container and is strictly prohibited by a `Restricted` Pod Security policy.

The `NET_BIND_SERVICE` capability allows a process to bind to privileged network ports (below 1024), and it is commonly among the few capabilities explicitly allowed by the Kubernetes `Restricted` Pod Security Standard profile as it's often required for standard application services.