Problem with capabilities

Most software doesn't modify it's capability set

Programs run as root automatically get all capabilities

No way to set only certain capabilities using suid/sgid bits.