Drop all capabilities a bit later, to avoid EACCESS from open(2).