The extended capabilities are marked as revocable by the granting process. Once received, the server process, as well as any other process within the server process' TRON domain, has the extended access. In no case does the granting of capabilities provide file access to the server beyond the existing UNIX permission system. The extended TRON domain then allows servers to fork off copies of themselves to perform the desired service and still retain the necessary capabilities. By judicious creation of the server's TRON domain, it's straightforward to ensure that unintended processes do not share in the granted rights.
Processes are free to grant any or all of their capabilities to other processes.
Multiple capabilities for the same object granted to the same process are each individually added to the receiving process' TRON domain-any one of these providing the necessary rights suffices for access to the object. This function serves more as a cleanup mechanism than as a security mechanism. We take the stance that the granting of a capability to another agent implies trusting that agent to be responsible with it. It is incumbent upon each direct grantor to explicitly revoke their granted rights prior to terminating. It first grants a specified subset of the TRON domain capabilities to an executing server process, then forks and executes the desired client program within the original domain.