I always understood the point being to split off some capabilities that can be used on their own safely, and leave the rest under CAP_SYS_ADMIN. Stuff like abil

I always understood the point being to split off some capabilities that can be used on their own safely, and leave the rest under CAP_SYS_ADMIN. Stuff like ability to bind to ports <1024 or configure network interfaces. So if most of the stuff stays under CAP_SYS_ADMIN, the system is working as designed.