The lab raises machines on the virtualisation daemon, and a module may mount a machine's socket only through the capability that grants it (novox/hq ADR 0172). Also brings the resolver's tests to the setting dnsmasq's listen addresses now come from, and to a module left out rather than refused.