[PATCH 5.16 0767/1017] selinux: allow FIOCLEX and FIONCLEX with policy capability