Which Linux capability flag must be dropped to prevent a container process from changing file ownership UIDs?