g_gate_drop_capabilities(), Teil 2

+       /* Only the client uses this. */
+       if (g_gate_devfd != -1) {
+               cap_rights_init(&rights, CAP_IOCTL, CAP_PREAD, CAP_PWRITE);
+               if (cap_rights_limit(g_gate_devfd, &rights) == -1) {
+                       g_gate_xlog("Unable to limit capability rights "
+                           "to CAP_IOCTL on ggate descriptor");
+               }
+               if (cap_ioctls_limit(g_gate_devfd, ggatecmds,
+                   sizeof(ggatecmds) / sizeof(ggatecmds[0])) == -1) {
+                       g_gate_xlog("Unable to limit allowed ggate ioctls");
+               }
+       }
+       cap_rights_init(&rights, CAP_PWRITE);
+       if (g_gate_logfd != -1 &&
+          cap_rights_limit(g_gate_logfd, &rights) == -1) {
+               g_gate_xlog("Unable to limit capability "
+                   "rights on logfd %d", g_gate_logfd);
+       }
+
+       g_gate_log(LOG_DEBUG, "Entered Capsicum sandbox");
+
+       return (0);
+}