remove level of nesting
clarify
make sure -x doesn't enable all syscalls if we've already done -r