ambient capabilities will be a whole lot nicer once more userspace stuff (like the pam caps stuff) supports them better. The idea for them comes from one of my

ambient capabilities will be a whole lot nicer once more userspace stuff (like the pam caps stuff) supports them better. The idea for them comes from one of my former coworkers, Christoph Lameter, when we were having issues with an app that needed CAP_NET_RAW for tcp sockets that we didn't want to be setuid root. Small world :)