I do not see a problem in that. You can always restrict the capability by not exporting a particular API function, or just by returning ENOPERM. It's the job of

I do not see a problem in that. You can always restrict the capability by not exporting a particular API function, or just by returning ENOPERM. It's the job of an operating environment to decide which permissions are available.