Add a new errno, ENOTCAPABLE, to be returned when a process requests an operation on a file descriptor that is not authorized by the descriptor's capability flags. Sponsored by: Google