set caps before flags so that caps can be changed in the same transaction
drwxr-xr-x - util-vserver