iproute2's ss utility tries to use CAP_SYS