Comment 1 for bug 1371695

This is likely better done in Debian.

That said, dpkg-statoverride seems like a possible layer to extend. It is responsible for updating the owner and permission of files installed by packages, after all. Extending it to deal with capabilities, or for that matter POSIX ACLs and Linux extended attributes would make sense.

One could then extend debhelper to make its usage more packager-friendly, if a dh_statoverride module doesn't exit already.

Until we get that, most packages will do it like iputils-ping does (refer to its postinst script).