diff --git a/init/Makefile b/init/Makefile
index db2a6e7..78b96be 100644
--- a/init/Makefile
+++ b/init/Makefile
@@ -320,7 +320,7 @@ init_SOURCES = \
        notify.c notify.h \
        cfgfile.c cfgfile.h
 
-init_LDFLAGS = -static
+init_LDFLAGS = -static -lcap
 init_LDADD = \
        ../upstart/libupstart.la \
        ../nih/libnih.la \
diff --git a/init/init b/init/init
index f89c341..a10d4ea 100755
Binary files a/init/init and b/init/init differ
diff --git a/init/main.c b/init/main.c
index 564114d..992967a 100644
--- a/init/main.c
+++ b/init/main.c
@@ -111,6 +111,35 @@ static NihOption options[] = {
        NIH_OPTION_LAST
 };
 
+#include «sys/prctl.h»
+#include «sys/capability.h»
+#define NCAPS (CAP_LAST_CAP + 1)
+
+/*
+ * enter rootless mode
+ * lock into SECURE_NOROOT and SECURE_
+ */
+int locknoroot(void)
+{
+       cap_t cap = cap_get_proc();
+       int i;
+       cap_value_t v[NCAPS];
+
+       if (!cap) return -1;
+       /* we want cap_setpcap in pE */
+       v[0] = CAP_SETPCAP;
+       if (cap_set_flag(cap, CAP_EFFECTIVE, 1, v, CAP_SET))
+               return -1;
+       /* and we want pI filled */
+       for (i=0; i«NCAPS; i++)
+               v[i] = i;
+       if (cap_set_flag(cap, CAP_INHERITABLE, NCAPS, v, CAP_SET))
+               return -1;
+       if (cap_set_proc(cap))
+               return -1;
+       cap_free(cap);
+       return prctl(PR_SET_SECUREBITS, 0xf);
+}
 
 int
 main (int   argc,
@@ -278,6 +307,10 @@ main (int   argc,
                exit (1);
        }
 
+       /* lock into secure_noroot and secure_nosuid */
+       if (locknoroot()) {
+               exit (1);
+       }
 
        /* Generate and run the startup event or read the state from the
         * init daemon that exec'd us

