diff --git a/bind-9.5-libcap.patch b/bind-9.5-libcap.patch
new file mode 100644
index 0000000..f4b7c37
--- /dev/null
+++ b/bind-9.5-libcap.patch
@@ -0,0 +1,268 @@
+diff -up bind-9.5.0b2/configure.in.libcap bind-9.5.0b2/configure.in
+--- bind-9.5.0b2/configure.in.libcap	2008-02-20 14:23:42.000000000 +0100
++++ bind-9.5.0b2/configure.in	2008-02-20 14:47:11.000000000 +0100
+@@ -1875,7 +1875,8 @@ AC_ARG_ENABLE(linux-caps,
+ 	[  --disable-linux-caps	disable linux capabilities])
+ case "$enable_linux_caps" in
+ 	yes|'')
+-		AC_CHECK_HEADERS(linux/capability.h)
++		AC_CHECK_HEADERS(sys/capability.h)
++		AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS")
+ 		;;
+ 	no)
+ 		;;
+diff -up bind-9.5.0b2/bin/named/unix/os.c.libcap bind-9.5.0b2/bin/named/unix/os.c
+--- bind-9.5.0b2/bin/named/unix/os.c.libcap	2008-02-20 14:24:31.000000000 +0100
++++ bind-9.5.0b2/bin/named/unix/os.c	2008-02-20 14:45:25.000000000 +0100
+@@ -60,16 +60,16 @@ static int devnullfd = -1;
+ #endif
+ 
+ /*
+- * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
++ * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
+  */
+-#ifndef HAVE_LINUX_CAPABILITY_H
++#ifndef HAVE_SYS_CAPABILITY_H
+ #undef HAVE_SYS_PRCTL_H
+ #endif
+ 
+ /*
+  * Linux defines:
+  *	(T) HAVE_LINUXTHREADS
+- *	(C) HAVE_LINUX_CAPABILITY_H
++ *	(C) HAVE_SYS_CAPABILITY_H
+  *	(P) HAVE_SYS_PRCTL_H
+  * The possible cases are:
+  *	none:	setuid() normally
+@@ -111,7 +111,7 @@ static struct passwd *runas_pw = NULL;
+ static isc_boolean_t done_setuid = ISC_FALSE;
+ static int dfd[2] = { -1, -1 };
+ 
+-#ifdef HAVE_LINUX_CAPABILITY_H
++#ifdef HAVE_SYS_CAPABILITY_H
+ 
+ static isc_boolean_t non_root = ISC_FALSE;
+ static isc_boolean_t non_root_caps = ISC_FALSE;
+@@ -125,7 +125,7 @@ static isc_boolean_t non_root_caps = ISC
+ #define _LINUX_FS_H
+ 
+ #include <sys/syscall.h>	/* Required for syscall(). */
+-#include <linux/capability.h>	/* Required for _LINUX_CAPABILITY_VERSION. */
++#include <sys/capability.h>	/* Required for _LINUX_CAPABILITY_VERSION. */
+ 
+ #ifdef HAVE_SYS_PRCTL_H
+ #include <sys/prctl.h>		/* Required for prctl(). */
+@@ -142,32 +142,16 @@ static isc_boolean_t non_root_caps = ISC
+ 
+ #endif /* HAVE_SYS_PRCTL_H */
+ 
+-#ifndef SYS_capset
+-#ifndef __NR_capset
+-#include <asm/unistd.h> /* Slackware 4.0 needs this. */
+-#endif
+-#define SYS_capset __NR_capset
+-#endif
+-
+ static void
+-linux_setcaps(unsigned int caps) {
+-	struct __user_cap_header_struct caphead;
+-	struct __user_cap_data_struct cap;
++linux_setcaps(cap_t caps) {
+ 	char strbuf[ISC_STRERRORSIZE];
+ 
+ 	if ((getuid() != 0 && !non_root_caps) || non_root)
+ 		return;
+ 
+-	memset(&caphead, 0, sizeof(caphead));
+-	caphead.version = _LINUX_CAPABILITY_VERSION;
+-	caphead.pid = 0;
+-	memset(&cap, 0, sizeof(cap));
+-	cap.effective = caps;
+-	cap.permitted = caps;
+-	cap.inheritable = 0;
+-	if (syscall(SYS_capset, &caphead, &cap) < 0) {
++	if (cap_set_proc(caps) < 0) {
+ 		isc__strerror(errno, strbuf, sizeof(strbuf));
+-		ns_main_earlyfatal("capset failed: %s:"
++		ns_main_earlyfatal("cap_set_proc failed: %s:"
+ 				   " please ensure that the capset kernel"
+ 				   " module is loaded.  see insmod(8)",
+ 				   strbuf);
+@@ -176,7 +160,9 @@ linux_setcaps(unsigned int caps) {
+ 
+ static void
+ linux_initialprivs(void) {
+-	unsigned int caps;
++	cap_t caps;
++	cap_value_t capval;
++	char strbuf[ISC_STRERRORSIZE];
+ 
+ 	/*%
+ 	 * We don't need most privileges, so we drop them right away.
+@@ -184,17 +170,26 @@ linux_initialprivs(void) {
+ 	 * capabilities to the minimum needed to run the server.
+ 	 */
+ 
+-	caps = 0;
++	if ( (caps = cap_init()) == NULL) {
++		isc__strerror(errno, strbuf, sizeof (strbuf));
++		ns_main_earlyfatal("cap_init failed: %s", strbuf);
++	}
+ 
+ 	/*
+ 	 * We need to be able to bind() to privileged ports, notably port 53!
+ 	 */
+-	caps |= (1 << CAP_NET_BIND_SERVICE);
++
++	capval = CAP_NET_BIND_SERVICE;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ 	/*
+ 	 * We need chroot() initially too.
+ 	 */
+-	caps |= (1 << CAP_SYS_CHROOT);
++
++	capval = CAP_SYS_CHROOT;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
+ 	/*
+@@ -203,19 +198,25 @@ linux_initialprivs(void) {
+ 	 * tried) or we're not using threads.  If either of these is
+ 	 * true, we want the setuid capability.
+ 	 */
+-	caps |= (1 << CAP_SETUID);
++	capval = CAP_SETUID;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ #endif
+ 
+ 	/*
+ 	 * Since we call initgroups, we need this.
+ 	 */
+-	caps |= (1 << CAP_SETGID);
++	capval = CAP_SETGID;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ 	/*
+ 	 * Without this, we run into problems reading a configuration file
+ 	 * owned by a non-root user and non-world-readable on startup.
+ 	 */
+-	caps |= (1 << CAP_DAC_READ_SEARCH);
++	capval = CAP_DAC_READ_SEARCH;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ 	/*
+ 	 * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
+@@ -224,14 +225,18 @@ linux_initialprivs(void) {
+ 	 * of files, the stack size, data size, and core dump size to
+ 	 * support named.conf options, this is now being added to test.
+ 	 */
+-	caps |= (1 << CAP_SYS_RESOURCE);
++	capval = CAP_SYS_RESOURCE;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ 	linux_setcaps(caps);
+ }
+ 
+ static void
+ linux_minprivs(void) {
+-	unsigned int caps;
++	cap_t caps;
++	cap_value_t capval;
++	char strbuf[ISC_STRERRORSIZE];
+ 
+ 	/*%
+ 	 * Drop all privileges except the ability to bind() to privileged
+@@ -241,8 +246,14 @@ linux_minprivs(void) {
+ 	 * chroot() could be used to escape from the chrooted area.
+ 	 */
+ 
+-	caps = 0;
+-	caps |= (1 << CAP_NET_BIND_SERVICE);
++	if ( (caps = cap_init()) == NULL) {
++		isc__strerror(errno, strbuf, sizeof (strbuf));
++		ns_main_earlyfatal("cap_init failed: %s", strbuf);
++	}
++
++	capval = CAP_NET_BIND_SERVICE;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ 	/*
+ 	 * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
+@@ -251,7 +262,9 @@ linux_minprivs(void) {
+ 	 * of files, the stack size, data size, and core dump size to
+ 	 * support named.conf options, this is now being added to test.
+ 	 */
+-	caps |= (1 << CAP_SYS_RESOURCE);
++	capval = CAP_SYS_RESOURCE;
++	cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET);
++	cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET);
+ 
+ 	linux_setcaps(caps);
+ }
+@@ -278,7 +291,7 @@ linux_keepcaps(void) {
+ }
+ #endif
+ 
+-#endif	/* HAVE_LINUX_CAPABILITY_H */
++#endif	/* HAVE_SYS_CAPABILITY_H */
+ 
+ 
+ static void
+@@ -295,7 +308,7 @@ setup_syslog(const char *progname) {
+ void
+ ns_os_init(const char *progname) {
+ 	setup_syslog(progname);
+-#ifdef HAVE_LINUX_CAPABILITY_H
++#ifdef HAVE_SYS_CAPABILITY_H
+ 	linux_initialprivs();
+ #endif
+ #ifdef HAVE_LINUXTHREADS
+@@ -474,7 +487,7 @@ ns_os_changeuser(void) {
+ 	done_setuid = ISC_TRUE;
+ 
+ #ifdef HAVE_LINUXTHREADS
+-#ifdef HAVE_LINUX_CAPABILITY_H
++#ifdef HAVE_SYS_CAPABILITY_H
+ 	if (!non_root_caps)
+ 		ns_main_earlyfatal("-u with Linux threads not supported: "
+ 				   "requires kernel support for "
+@@ -507,7 +520,7 @@ ns_os_changeuser(void) {
+ 				     strbuf);
+ 	}
+ #endif
+-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
++#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+ 	linux_minprivs();
+ #endif
+ }
+@@ -522,7 +535,7 @@ ns_os_minprivs(void) {
+ 	ns_os_changeuser(); /* Call setuid() before threads are started */
+ #endif
+ 
+-#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
++#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
+ 	linux_minprivs();
+ #endif
+ }
+diff -up bind-9.5.0b2/config.h.in.libcap bind-9.5.0b2/config.h.in
+--- bind-9.5.0b2/config.h.in.libcap	2008-02-20 14:23:57.000000000 +0100
++++ bind-9.5.0b2/config.h.in	2008-02-20 14:24:17.000000000 +0100
+@@ -196,8 +196,8 @@ int sigwait(const unsigned int *set, int
+ /* Define if libxml2 was found */
+ #undef HAVE_LIBXML2
+ 
+-/* Define to 1 if you have the <linux/capability.h> header file. */
+-#undef HAVE_LINUX_CAPABILITY_H
++/* Define to 1 if you have the <sys/capability.h> header file. */
++#undef HAVE_SYS_CAPABILITY_H
+ 
+ /* Define to 1 if you have the <locale.h> header file. */
+ #undef HAVE_LOCALE_H
diff --git a/bind.spec b/bind.spec
index dc1add4..0b198da 100644
--- a/bind.spec
+++ b/bind.spec
@@ -19,7 +19,7 @@ Summary: 	The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name: 		bind
 License: 	ISC
 Version: 	9.5.0
-Release: 	27.%{RELEASEVER}%{?dist}
+Release: 	28.%{RELEASEVER}%{?dist}
 Epoch:   	32
 Url: 		http://www.isc.org/products/BIND/
 Buildroot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -61,6 +61,7 @@ Patch72:	bind-9.5-dlz-64bit.patch
 Patch87:	bind-9.5-parallel-build.patch
 Patch88:	bind-9.5-transfer-segv.patch
 Patch89:	bind-9.5-mudflap.patch
+Patch90:	bind-9.5-libcap.patch
 
 # SDB patches
 Patch11: 	bind-9.3.2b2-sdbsrc.patch
@@ -83,13 +84,15 @@ Patch83:	bind-9.5-libidn2.patch
 Patch85:	bind-9.5-libidn3.patch
 
 #
-Requires:	bind-libs = %{epoch}:%{version}-%{release}, glibc  >= 2.2, mktemp
+Requires:	mktemp
 Requires(post): grep, chkconfig >= 1.3.26
 Requires(pre): 	shadow-utils
 Requires(preun):chkconfig >= 1.3.26
 Obsoletes: bind-config, caching-nameserver
 Provides:  bind-config, caching-nameserver
-BuildRequires: 	gcc, glibc-devel >= 2.2.5-26,  glibc-kernheaders >= 2.4-7.10, openssl-devel, libtool, autoconf, pkgconfig
+BuildRequires: 	gcc, glibc-devel >= 2.2.5-26,  glibc-kernheaders >= 2.4-7.10
+BuildRequires:	openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
+BuildRequires:  libidn-devel
 %if %{SDB}
 BuildRequires:  openldap-devel, postgresql-devel, sqlite-devel, mysql-devel, unixODBC-devel
 %endif
@@ -101,13 +104,10 @@ BuildRequires:  net-tools, perl
 %endif
 %if %{GSSTSIG}
 BuildRequires:	krb5-devel
-Requires:	krb5-libs
 %endif
 %if %{DEBUG}
 BuildRequires:	libmudflap-devel
 %endif
-BuildRequires:  libidn-devel
-Requires:       libidn
 
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -120,7 +120,6 @@ tools for verifying that the DNS server is operating properly.
 %package sdb
 Summary: BIND server with database backends and DLZ suppport
 Group:   System Environment/Daemons
-Requires: bind = %{epoch}:%{version}-%{release}
 
 %description sdb
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -145,7 +144,6 @@ Contains libraries used by both the bind server package as well as the utils pac
 %package  utils
 Summary:  Utilities for querying DNS name servers
 Group:    Applications/System
-Requires: bind-libs = %{epoch}:%{version}-%{release}
 
 %description utils
 Bind-utils contains a collection of utilities for querying DNS (Domain
@@ -161,7 +159,6 @@ servers.
 %package   devel
 Summary:   Header files and libraries needed for BIND DNS development
 Group:     Development/Libraries
-Requires:  bind-libs = %{epoch}:%{version}-%{release}
 Obsoletes: bind-libbind-devel
 
 %description devel
@@ -173,7 +170,6 @@ required for development with ISC BIND 9 and BIND 8
 Summary:   A chroot runtime environment for the ISC BIND DNS server, named(8)
 Group: 	   System Environment/Daemons
 Prefix:    %{chroot_prefix}
-Requires:    bind = %{epoch}:%{version}-%{release}
 Requires(post):  grep
 Requires(preun): grep
 
@@ -192,6 +188,7 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %patch10 -p1 -b .PIE
 %patch69 -p1 -b .generate-xml
 %patch16 -p1 -b .redhat_doc
+%patch90 -p1 -b .libcap
 %if %{SDB}
 mkdir bin/named-sdb
 cp -r bin/named/* bin/named-sdb
@@ -278,11 +275,10 @@ fi
 %configure \
 	--with-libtool \
 	--localstatedir=/var \
-	--disable-threads \
+	--enable-threads \
 	--enable-ipv6 \
 	--with-pic \
 	--disable-openssl-version-check \
-	--disable-linux-caps \
 %if %{LIBBIND}
 	--enable-libbind \
 %endif
@@ -659,6 +655,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/bind-chroot-admin
 
 %changelog
+* Wed Feb 20 2008 Adam Tkac <atkac redhat com> 32:9.5.0-28.b2
+- port named to use libcap library, enable threads (#433102)
+- removed some unneeded Requires
+
 * Tue Feb 19 2008 Adam Tkac <atkac redhat com> 32:9.5.0-27.b2
 - removed conditional build with libefence (use -fmudflapth instead)
 - fixed building of DLZ stuff (#432497)