The "IRIX Capabilities" page that you sent out is one implementation of something that came out of the POSIX security work -- a total botch, I might add.
What POSIX calls capabilities is really a set of per-process attribute restrictions. These are not capabilities in the classical sense at all, and it is *very* unfortunate that the POSIX committee chose that name. For example, they are not transferrable.
Mind you, what POSIX calls for is a significant improvement over the base mechanisms in POSIX.
Just wanted to alert you not to get confused.
Jonathan S. Shapiro
IBM T.J. Watson Research Center
Email: shapj@us.ibm.com
Phone: +1 914 784 7085 (Tieline: 863)
Fax: +1 914 784 7595