ubuntu template: disallow cap_sys_module (by popular demand)
ubuntu template: disallow cap_sys_module (by popular demand)

This isn't particularly reassuring, and will be moot with user
namespaces, but as people are asking for it, turn off sys_module.
While we're at it, turn off mac_admin and mac_override.

Signed-off-by: Serge Hallyn <3df611b026e4639bee8aef7a4beb2e39fcebb313@canonical.com>
Signed-off-by: Daniel Lezcano <3211518dd4d87cb3f7ee12cb52e14b7fb2bc0446@fr.ibm.com>

QingweiPeterLan/cs188-lxc,inokappa/lxc,codebauss/lxc,JohnPeacockMessageSystems/lxc,hallyn/lxc,LynxChaus/lxc,fwilson42/lxc,smoser/lxc,thmo/lxc,GreatFruitOmsk/lxc,bostjan/lxc,efiop/lxc,major/lxc,Ponce/lxc,weizhenwei/lxc,ioops/lxc,bmoar/lxc,aeris/lxc,jirislaby/lxc,fwilson42/lxc,szaszg/lxc,smoser/lxc,glensc/lxc,codebauss/lxc,jirislaby/lxc,rowhit/lxc,virajs/lxc,Pelagicore/lxc,sapun/lxc,cjwatson/lxc,lazy404/lxc,caglar10ur/lxc,tych0/lxc,ostap/lxc,Distrotech/lxc,GreatFruitOmsk/lxc,bostjan/lxc,cjwatson/lxc,smoser/lxc,rowhit/lxc,sapun/lxc,hfuCN/lxc,yubo/lxc,christiaan/lxc,QingweiPeterLan/cs188-lxc,lisongmin/lxc,bmoar/lxc,raspberrypython/lxc,LynxChaus/lxc,armcc/lxc,yubo/lxc,potatosalad/lxc,abstrakraft/lxc-android-lxc,Distrotech/lxc,coconutpilot/lxc-gentoo-new,efiop/lxc,sapun/lxc,bmoar/lxc,armcc/lxc,ysbnim/lxc,raspberrypython/lxc,ecarrara/lxc,aeris/lxc,virajs/lxc,ioops/lxc,ecarrara/lxc,coconutpilot/lxc-gentoo-new,ysbnim/lxc,caglar10ur/lxc,smoser/lxc,cjwatson/lxc,tych0/lxc,ss1h2a3tw/lxc,ecarrara/lxc,regit/lxc,lisongmin/lxc,QingweiPeterLan/cs188-lxc,ioops/lxc,federicobriata/lxc,lisongmin/lxc,GreatFruitOmsk/lxc,hallyn/lxc,ysbnim/lxc,glensc/lxc,glensc/lxc,fwilson42/lxc,regit/lxc,lazy404/lxc,caglar10ur/lxc,ojkastl/lxc_Patches,akshaykarle/lxc,JohnPeacockMessageSystems/lxc,christiaan/lxc,rldleblanc/lxc,rldleblanc/lxc,ostap/lxc,regit/lxc,hkjolhede/lxc,ksperis/lxc,szaszg/lxc,armcc/lxc,christiaan/lxc,hallyn/lxc,federicobriata/lxc,hkjolhede/lxc,rldleblanc/lxc,terceiro/lxc,bostjan/lxc,DarknessBeforeDawn/lxc,virajs/lxc,ss1h2a3tw/lxc,yubo/lxc,abstrakraft/lxc-android-lxc,LynxChaus/lxc,jirislaby/lxc,inokappa/lxc,lazy404/lxc,weizhenwei/lxc,Pelagicore/lxc,thmo/lxc,akshaykarle/lxc,codebauss/lxc,DarknessBeforeDawn/lxc,hfuCN/lxc,Ponce/lxc,ksperis/lxc,szaszg/lxc,hfuCN/lxc,Ponce/lxc,raspberrypython/lxc,akshaykarle/lxc,ojkastl/lxc_Patches,JohnPeacockMessageSystems/lxc,Distrotech/lxc,major/lxc,abstrakraft/lxc-android-lxc,potatosalad/lxc,aeris/lxc,ksperis/lxc,ojkastl/lxc_Patches,ojkastl/lxc_Patches,federicobriata/lxc,efiop/lxc,tych0/lxc,hkjolhede/lxc,ss1h2a3tw/lxc,Pelagicore/lxc,abstrakraft/lxc-android-lxc,major/lxc,thmo/lxc,terceiro/lxc,rowhit/lxc,terceiro/lxc,weizhenwei/lxc,DarknessBeforeDawn/lxc