How do "capabilities" work in Linux?

Question

linux

Found the following https://wiki.archlinux.org/index.php/Capabilities
1) Do I understand correctly that a normal user can download a program with privileges exceeded or set them themselves using setcap?
2) won't ping etc. work on Arch Linux if you put the system on ZFS?
3)

Arch does not support any MAC/RBAC systems

from https://wiki.archlinux.org/index.php/Capabilities#... So SELinux doesn't work on Arch Linux or what? (source: https://wiki.archlinux.org/index.php/Security#Mand... )

Answer 1

Do I understand correctly that a normal user can download a program with privileges exceeded or set them on their own using setcap?

No. In order to execute setcap you need to have CAP_SETFCAP. Here's what man capabilities says about it:
I don't know anything about ZFS, but if it doesn't support extended attributes, no-suid ping won't work. But you can always give it to root and set the SUID bit.