Need to fork test that cap_enter()s; also check rights explicitly