diff --color -ru a/libcap/cap_proc.c b/libcap/cap_proc.c

--- a/libcap/cap_proc.c	2021-12-22 12:33:20.739126763 +0100

+++ b/libcap/cap_proc.c	2021-12-22 12:33:53.195733115 +0100

@@ -406,6 +406,29 @@

 }

 /*

+ * cap_prctl performs a prctl() 6 argument call on the current

+ * thread. Use cap_prctlw() if you want to perform a POSIX semantics

+ * prctl() system call.

+ */

+int cap_prctl(long int pr_cmd, long int arg1, long int arg2,

+             long int arg3, long int arg4, long int arg5)

+{

+    return prctl(pr_cmd, arg1, arg2, arg3, arg4, arg5);

+}

+

+/*

+ * cap_prctlw performs a POSIX semantics prctl() call. That is a 6 arg

+ * prctl() call that executes on all available threads when libpsx is

+ * linked. The suffix 'w' refers to the fact one only ever needs to

+ * invoke this is if the call will write some kernel state.

+ */

+int cap_prctlw(long int pr_cmd, long int arg1, long int arg2,

+              long int arg3, long int arg4, long int arg5)

+{

+    return _libcap_wprctl6(&multithread, pr_cmd, arg1, arg2, arg3, arg4, arg5);

+}

+

+/*

  * Some predefined constants

  */

 #define CAP_SECURED_BITS_BASIC                                 \

diff --color -ru a/libcap/include/sys/capability.h b/libcap/include/sys/capability.h

--- a/libcap/include/sys/capability.h	2021-02-05 06:52:17.000000000 +0100

+++ b/libcap/include/sys/capability.h	2021-12-22 12:33:53.196733134 +0100

@@ -175,6 +175,11 @@

 extern unsigned cap_get_secbits(void);

 extern int cap_set_secbits(unsigned bits);

+extern int cap_prctl(long int pr_cmd, long int arg1, long int arg2,

+		    long int arg3, long int arg4, long int arg5);

+extern int cap_prctlw(long int pr_cmd, long int arg1, long int arg2,

+		     long int arg3, long int arg4, long int arg5);

+

 extern int cap_setuid(uid_t uid);

 extern int cap_setgroups(gid_t gid, size_t ngroups, const gid_t groups[]);

diff --color -ru a/pam_cap/pam_cap.c b/pam_cap/pam_cap.c

--- a/pam_cap/pam_cap.c	2021-12-22 12:33:20.740126781 +0100

+++ b/pam_cap/pam_cap.c	2021-12-22 12:33:53.196733134 +0100

@@ -21,6 +21,7 @@

 #include <string.h>

 #include <syslog.h>

 #include <sys/capability.h>

+#include <sys/prctl.h>

 #include <sys/types.h>

 #include <linux/limits.h>

@@ -33,8 +34,11 @@

 struct pam_cap_s {

     int debug;

+    int keepcaps;

+    int defer;

     const char *user;

     const char *conf_filename;

+    pam_handle_t *pamh;

 };

 /*

@@ -178,6 +182,33 @@

 }

 /*

+ * This is the "defer" cleanup function that actually applies the IAB

+ * tuple. This happens really late in the PAM session, hopefully after

+ * the application has performed its setuid() function.

+ */

+static void iab_apply(pam_handle_t *pamh, void *data, int error_status)

+{

+    cap_iab_t iab = data;

+    int retval = error_status & ~(PAM_DATA_REPLACE|PAM_DATA_SILENT);

+

+    data = NULL;

+    if (error_status & PAM_DATA_REPLACE) {

+	goto done;

+    }

+

+    if (retval != PAM_SUCCESS || !(error_status & PAM_DATA_SILENT)) {

+	goto done;

+    }

+

+    if (cap_iab_set_proc(iab) != 0) {

+	D(("IAB setting failed"));

+    }

+

+done:

+    cap_free(iab);

+}

+

+/*

  * Set capabilities for current process to match the current

  * permitted+executable sets combined with the configured inheritable

  * set.

@@ -230,12 +261,21 @@

 	goto cleanup_conf;

     }

-    if (!cap_iab_set_proc(iab)) {

+    if (cs->defer) {

+	D(("configured to delay applying IAB"));

+	pam_set_data(cs->pamh, "pam_cap_iab", iab, iab_apply);

+	iab = NULL;

+    } else if (!cap_iab_set_proc(iab)) {

 	D(("able to set the IAB [%s] value", conf_caps));

 	ok = 1;

     }

     cap_free(iab);

+    if (cs->keepcaps) {

+	D(("setting keepcaps"));

+	(void) cap_prctlw(PR_SET_KEEPCAPS, 1, 0, 0, 0, 0);

+    }

+

 cleanup_conf:

     memset(conf_caps, 0, conf_caps_length);

     _pam_drop(conf_caps);

@@ -268,6 +308,10 @@

 	    pcs->debug = 1;

 	} else if (!strncmp(*argv, "config=", 7)) {

 	    pcs->conf_filename = 7 + *argv;

+	} else if (!strcmp(*argv, "keepcaps")) {

+	    pcs->keepcaps = 1;

+	} else if (!strcmp(*argv, "defer")) {

+	    pcs->defer = 1;

 	} else {

 	    _pam_log(LOG_ERR, "unknown option; %s", *argv);

 	}

@@ -353,6 +397,7 @@

 	return PAM_AUTH_ERR;

     }

+    pcs.pamh = pamh;

     retval = set_capabilities(&pcs;;

     memset(&pcs, 0, sizeof(pcs));