+++ This bug was initially created as a clone of Bug #646443 +++ Description of problem: Please remove setuid setup of files in your package with file capabilities. This is to satisfy the F15 feature. https://fedoraproject.org/wiki/Features/RemoveSETUID An example of how this was done for X is. %if 0%{?fedora} < 15 %define Xorgperms %attr(4711, root, root) %else %define Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe) %endif
There are two simple helpers with setuid bit in pam - unix_chkpwd and pam_timestamp_check. Both would need cap_dac_override. The unix_chkpwd would also need cap_audit_write.
Note that changing to capabilities instead of setuid on unix_chkpwd has potential to break some specific configurations such as using pam_unix to authenticate users with hashes obtained from LDAP server with nss_ldap. So I am not sure the very small benefit of having cap_dac_override instead of setuid is worth the potential regressions.
Ok lets close these as wontfix