Quoting david@lang.hm (david@lang.hm): > I can see what you would want to allow for a syslog daemon to have > CAP_SYSLOG without needing to have CAP_SYS_ADMIN, but why do you see > it as important to deny the ability if someone has CAP_SYS_ADMIN?
Good point, most of its use is in going the other way.