default {
	uid any
	gid any
	groups yes

	log security
	ignore no

	chroot yes
	root default

	cap default		// does not modify capabilities after execve
	uidcap default		// restores standard behavior of set*uids

	exec allow all
}
