LSM: generalize flag passing to security_capable