Check if we have CAP_SYS_ADMIN. Drop namespace forking if we don't.