This is enforced by e.g. the `ss` tool.

This is an error with clang, so avoid it.

This is the order Linux header uses, so let's switch to it.

This is more accurate than protocol, since e.g. SOCK_STREAM implies TCP

This change is introduced because suddenly CAP_NET_ADMIN
stopped working for my Arch Linux. In essence, doing

$ sudo setcap cap_net_admin=ep $(which ip)

Has no effect anymore:

$ ip link set dev tap0 up
RTNETLINK answers: Operation not permitted

Searching the Internet, one error case is if the directory is mounted
with `nosuid`, but this does not seem to be the case in my Linux.

Since iproute2 changed its capability handling, seems like it is
simpler to just guide the user to create the tap device itself.

This is also what Google's Netstack does.

iproute2/iproute2@9b13cc9

This reverts commit 72e4c27.