allow both 'CAP_xxx' and 'xxx'
drwxr-xr-x - util-vserver