a couple of patches

Here's a couple of patches I came up with while updating the SELinux policy for icecream in Fedora
and could be useful to have in upstream:

- icecc-create-env: avoid tar looking at /etc/passwd
  a minor change that allows me to have the SELinux policy more restrictive.

- daemon: improve capabilities dropping
  bugfix