less invasive privileges drop when chown-socket is in place