Added SETUID capability too (it's obviously needed). Also upgraded to Linux capability version 3 (which is 64bit -> no kernel warning).