[neilalexander]

The CAP_NET_BIND_SERVICE capability on Linux is far less of a blunt instrument that applies to a single process rather than system-wide.