diff -up dhcp-4.1.1/client/dhclient.c.capability dhcp-4.1.1/client/dhclient.c
--- dhcp-4.1.1/client/dhclient.c.capability	2010-01-20 17:39:07.000000000 +0100
+++ dhcp-4.1.1/client/dhclient.c	2010-01-20 17:39:07.000000000 +0100
@@ -37,6 +37,9 @@
 #include <sys/time.h>
 #include <sys/wait.h>
 #include <limits.h>
+#ifdef HAVE_LIBCAP_NG
+#include <cap-ng.h>
+#endif
 
 /*
  * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
@@ -424,6 +427,15 @@ main(int argc, char **argv) {
 		path_dhclient_script = s;
 	}
 
+#ifdef HAVE_LIBCAP_NG
+	/* Drop capabilities */
+	capng_clear(CAPNG_SELECT_BOTH);
+	capng_updatev(CAPNG_ADD,
+			CAPNG_EFFECTIVE|CAPNG_PERMITTED|CAPNG_BOUNDING_SET,
+			CAP_NET_ADMIN, CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
+	capng_apply(CAPNG_SELECT_BOTH);
+#endif
+
 	/* Set up the initial dhcp option universe. */
 	initialize_common_option_spaces();
 
diff -up dhcp-4.1.1/client/Makefile.am.capability dhcp-4.1.1/client/Makefile.am
--- dhcp-4.1.1/client/Makefile.am.capability	2008-11-18 23:33:22.000000000 +0100
+++ dhcp-4.1.1/client/Makefile.am	2010-01-20 17:39:07.000000000 +0100
@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c 
 		   scripts/netbsd scripts/nextstep scripts/openbsd \
 		   scripts/solaris scripts/openwrt
 dhclient_LDADD = ../common/libdhcp.a ../minires/libres.a \
-		 ../omapip/libomapi.a ../dst/libdst.a
+		 ../omapip/libomapi.a ../dst/libdst.a $(CAPNG_LDADD)
 man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
 EXTRA_DIST = $(man_MANS)
 
diff -up dhcp-4.1.1/configure.ac.capability dhcp-4.1.1/configure.ac
--- dhcp-4.1.1/configure.ac.capability	2010-01-20 17:39:07.000000000 +0100
+++ dhcp-4.1.1/configure.ac	2010-01-20 17:39:07.000000000 +0100
@@ -419,6 +419,9 @@ AC_TRY_LINK(
 # Look for optional headers.
 AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
 
+# look for capabilities library
+LIBCAP_NG_PATH
+
 # find an MD5 library
 AC_SEARCH_LIBS(MD5_Init, [crypto])
 AC_SEARCH_LIBS(MD5Init, [crypto])