cap-bs-keep
no-new-privs
umask 077
ro-sys
ro-home
private-tmp
run-dir
u pcscd
