Unix domain sockets and MAC confined processes as (object) capability system?

On Linux there are three interesting facilities regarding privilege 
separation:

1) Using MAC (SELinux/AppArmor/etc) a process can be functionally cut of 
from access
    to most of the file-system.
2) Using UID based firewall rules, a process running under a particular 
UID can be functionally
    cut of from initiating or directly accepting any network traffic.
3) Using Unix domain sockets, open file, network connection handles and 
importantly other Unix
    domain sockets can be handed over between processes.

If you combine these three techniques and keep the code-base of 
individual processes relatively small, you will have a privilege 
separated system that, if you consider a small-code-base process to be a 
coarse grained object, and if you consider the  Unix domain sockets, 
network connections and open file handles to be capabilities, has 
approximately the same semantic structure that a small program in an 
object capability language has.

As such I've considered this type of privilege separation to effectively 
be not just a capability system but actually an object-capability 
system.

Given some recent discussions however, I've found that either I'm wrong 
about this assertion, or that this view is simply confusing to people as 
multiple capability people seem to strongly be opposed to the idea that 
file handles on Unix could be capabilities at all, let alone object 
capabilities.

My questions thus are:

* Are there any reasons why a privilege separated program that uses a 
combination of above
   techniques would not qualify as a capability system?
* Are there reasons why open network connections, file handles and Unix 
domain sockets would
   not qualify as (object) capabilities?

Kind regards,

Rob