The default values for the capabilities should be false except for MKNOD.  Maybe we can make this a little more clear somehow?