hmm after much bickering^H^H^H^H discussion with xs the resident security bigot of #argv it turns out there isnt a patch to assign root capabilities to specific gids (and then kludge setgid to set egid like it does for root as they are technically root privs). shame. *sniff*. and I'll just put it on my big TODO list.