capabilities: Only plugins that require CAP_NET_ADMIN demand it

The daemon as such does not require this capability.

src/libcharon/daemon.c

@@ -33,10 +33,6 @@
 #include <processing/jobs/start_action_job.h>
 #include <threading/mutex.h>
 
-#ifndef CAP_NET_ADMIN
-#define CAP_NET_ADMIN 12
-#endif
-
 #ifndef LOG_AUTHPRIV /* not defined on OpenSolaris */
 #define LOG_AUTHPRIV LOG_AUTH
 #endif
@@ -624,12 +620,6 @@ bool libcharon_init(const char *name)
 
 	this = daemon_create(name);
 
-	if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN))
-	{
-		dbg(DBG_DMN, 1, "libcharon requires CAP_NET_ADMIN capability");
-		return FALSE;
-	}
-
 	/* for uncritical pseudo random numbers */
 	srandom(time(NULL) + getpid());
 

src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c

@@ -102,6 +102,13 @@ plugin_t *kernel_libipsec_plugin_create()
 {
 	private_kernel_libipsec_plugin_t *this;
 
+	if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN))
+	{	/* required to create TUN devices */
+		DBG1(DBG_KNL, "kernel-libipsec plugin requires CAP_NET_ADMIN "
+			 "capability");
+		return NULL;
+	}
+
 	INIT(this,
 		.public = {
 			.plugin = {