---- jail default policy (should all be 0): ----
jail.defaults.allow_raw_sockets: 0
jail.defaults.vfs_mount_nullfs: 0
jail.defaults.vfs_mount_tmpfs: 0
jail.defaults.vfs_mount_devfs: 0
jail.defaults.vfs_mount_procfs: 0
---- running bypass as root (will create + enter jail): ----
jail() ok: jid=2  (now jailed as uid=0)
=== DF-0165 demo: cap-gated actions inside jail ===
    (jail default policy: allow_raw_sockets=0,
     vfs_mount_{nullfs,tmpfs,devfs,procfs}=0 -> all should EPERM)
  socket(AF_INET, SOCK_RAW, IPPROTO_RAW)  -> Operation not permitted (errno=1)  -- correctly denied
  mount("tmpfs", /tmp/df0165-mnt-tmpfs)  [SYSCAP_NOMOUNT_TMPFS] -> Operation not permitted (errno=1)
  mount("null", /tmp/df0165-mnt-nullfs)  [SYSCAP_NOMOUNT_NULLFS] -> Operation not permitted (errno=1)
  mount("devfs", /tmp/df0165-mnt-devfs)  [SYSCAP_NOMOUNT_DEVFS] -> Operation not permitted (errno=1)
  mount("procfs", /tmp/df0165-mnt-procfs)  [SYSCAP_NOMOUNT_PROCFS] -> Operation not permitted (errno=1)
=== end: 0 cap-gated action(s) bypassed jail policy ===