What does "CAPABILITY ALL -TCB" mean?

It means that all capabilities excluding TCB are assigned. Capability names prefixed by "-" indicate which capabilities to exclude.