This addition adds a build-time option that's linux specific.
It drops any capabilities assigned to the process at launch time (if it were launched as root, root loses all special meaning). It also removes all capabilities from the binding set and locks all options related to privilege escalation so that they may not be changed.
For these options to work (if built) the binary must be setuid root (horrible) or setcap cap_setpcap+eip bitcoind; (awesome) It only needs this capability so that it can clear the bounding set which it does in main() of bitcoind very first thing. I am not sure where the code needs to go to make it function in bitcoin gui client?
For more details make sure you have libcap2-dev install and: man 7 capabilities man 2 prctl
The relevant sections of prctl(2) are: PR_CAPBSET_DROP and PR_SET_SECUREBITS.
This patch will make it so that (barring issues in the posix11.e implementation in the kernel itself) any code execution vulnerabilities in the future will be unable to gain escalated privileges through the bitcoind process. Even by exec()'ing suid binaries and exploiting known issues with them.