David, here is a new version taking into account your feedback from yesterday. Eric, it has changed quite a bit since you last looked at it, so if you have a chance to take another look that'd be great. It's still just the general cleanup, no handling of cross-userns capabilities or file accesses :) thanks, -serge