--- orig/src/capplet/capplet.c
+++ mod/src/capplet/capplet.c
@@ -23,6 +23,15 @@
 #include <gtk/gtkwindow.h>
 #include <gconf/gconf-client.h>
 #include <libburn/libburn.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <linux/hdreg.h>
+#include <sys/capability.h>
+#include <stdio.h>
+#include <sys/prctl.h>
 
 #include "../library/coaster.h"
 
@@ -34,12 +43,53 @@
   gpointer drives;
   int n_drives;
   GConfClient *gconf_client;
+  cap_t capabilities;
+
+  capabilities = cap_get_proc();
+  printf("1Capabilities are %s\n",cap_to_text(capabilities,NULL));
+  printf("Uid is %d, euid is %d\n",getuid(),geteuid());
+  cap_free(capabilities);
+
+  /* The only capability we want is sys_rawio */
+  capabilities = cap_from_text("= cap_sys_rawio=ep");
+  /* So drop all the others */
+  cap_set_proc(capabilities);
+  /* free the capabilities */
+  cap_free(capabilities);
+  /* We need to do this so we keep capabilities over the setuid */
+  prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
+  /* And now change to the user who called us, rather than the suid
+     user */
+
+/*      if (setuid(getuid())) {
+                perror("setuid");
+                } */
+
+  setresuid(getuid(),getuid(),getuid());
+
+  /* And drop the ability to keep caps across switches */
+  prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
+
+  /* This stuff just shows that the above works */
+  capabilities = cap_get_proc();
+  printf("2Capabilities are %s\n",cap_to_text(capabilities,NULL));
+  printf("Uid is %d, euid is %d\n",getuid(),geteuid());
+  cap_free(capabilities);
+
+  uid_t ruid, euid, suid;
+  int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid);
+
+  getresuid(&ruid,&euid,&suid);
+  printf("r %d e %d, s %d\n",ruid,euid,suid);
 
   gnome_program_init ("gnome-burn-preferences", VERSION, LIBGNOMEUI_MODULE,
                       argc, argv,
                       GNOME_PARAM_APP_DATADIR, DATADIR, NULL);
 
   gtk_set_locale ();
+  capabilities = cap_from_text("= cap_sys_rawio=eip");
+  cap_set_proc(capabilities);
+  cap_free(capabilities);
 
   if(!coaster_init (&drives, &n_drives, TRUE)) return 1;