If you write a program that wants to grant file capabilities to anything without also containing code that performs sanity checks or some form of authentication, you can. (Programmers can write code to do all sorts of things.)
/sbin/setcap is such a program:
$ cp /sbin/setcap ./easycap
$ chmod go-rwx ./easycap
$ sudo ./easycap cap_setfcap=p ./easycap
$ ./easycap =ep ./easycap
$ /sbin/getcap ./easycap
setuid-root programs that can also do the same thing, here, the
chmod go-rwx ./easycap restricts access to this powerful binary to just the
To grant this program the
cap_setfcap capability, the program has to get it from somewhere. In this case, the
sudo user is granting this binary permission to give any file capability to any binary it can write to.
That is, it is the
sudo invoker who thinks this whole arrangement is a good idea. Done this way, or on a single user system, this might be really handy for an admin that understands all the ways this could be abused. In other, more likely, situations this might not be such a great idea.