On the fly changes

If you need to install a new program, do a fsck, have httpd temporary access some files, you could change the capabilities set and permissions of a process modifying lids.conf, having LIDS reload it and relaunching the process. This is not really effective.

This is why you can overload the capabilities set or the permission rules of a specified process (by its pid). Each time you overload a capabilities set or you add a permissions rule, you give a tag to the overload. Then you can remove overloads by pid or by tags, or you can remove all the overloads. You can overload as many times as you want an overloaded process.