Fix generic cgroup subsystem permission checks