jsvc did not properly drop capabilities, therefore allowing applications to access files owned by the super user .