capabilities: CAP_CHOWN might be required by many plugins opening UNIX sockets