diff --git a/configure.ac b/configure.ac
index e81ed1e8f..06d07ee05 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1297,6 +1297,12 @@ if test x$capabilities = xlibcap; then
 	AC_DEFINE([CAPABILITIES_LIBCAP], [], [have libpcap library])
 fi
 
+if test x$capabilities = xno -a x$ac_cv_func_prctl = xyes -a "x$ipsecuser" != xroot; then
+	AC_MSG_WARN(m4_normalize([
+		no capability backend selected, the daemon will be unable to restrict
+		root-derived capabilities when changing to an unprivileged user]))
+fi
+
 if test x$selinux = xtrue; then
 	PKG_CHECK_MODULES(selinux, [libselinux])
 	AC_SUBST(selinux_CFLAGS)
diff --git a/src/libstrongswan/utils/capabilities.c b/src/libstrongswan/utils/capabilities.c
index 9836fc9bb..536514953 100644
--- a/src/libstrongswan/utils/capabilities.c
+++ b/src/libstrongswan/utils/capabilities.c
@@ -422,9 +422,13 @@ METHOD(capabilities_t, drop, bool,
 {
 #ifndef WIN32
 #ifdef HAVE_PRCTL
-	if (has_capability(this, CAP_SETPCAP, NULL))
+	if (this->uid && has_capability(this, CAP_SETPCAP, NULL))
 	{
 		prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
+#ifndef CAPABILITIES
+		DBG0(DBG_LIB, "no capability backend compiled in, privilege drop will "
+			 "preserve root-derived permitted capabilities");
+#endif
 	}
 #endif