"Deny server sockets to group" not working as expected