Description of the problem:

Actually, rsyslogd is running with full set of capabilities. Whilst it's possible for rsyslog to drop privileges by impersonating as another user and/or group after startup, there are some modules that explicitly require root user rights. Thus, it's necessary to drop the capabilities to only the necessary set, to minimize security exposure in case there was ever a mistake in a networking plugin or some other input resource. The change should be done directly in the code with libcap-ng as rsyslog has many optional modules and some of them require additional capabilities.