Re: Should login managers use CapabilityBoundingSet=~CAP_SYS_PTRACE in their services ?

[Marco d'Itri <md@Linux.IT>]

On Jan 04, Lorenzo <plorenzo@disroot.org> wrote:

> Slim upstream added
> CapabilityBoundingSet=~CAP_SYS_PTRACE
> to the slim.service file, apparently to silence lintian messages [1].
> This breaks some admin commands [2] in a non obvious way and so causes
> surprise to users.
Indeed, this is just wrong: while sandboxing and hardening daemons is 
generally a good idea, a login manager should not restrict the 
capabilities of the user's session.

--
ciao,
Marco

Attachment: signature.asc
Description: PGP signature