I wanted to add a current data point to #938987: this issue is still reproducible on Debian trixie with the packaged NSD version nsd 4.12.0-1 We encountered the same failure mode with the packaged nsd.service: NSD is unable to access state/files that are otherwise valid for the configured NSD user because the service's CapabilityBoundingSet removes the DAC-related capability required to traverse/access the relevant path. The immediate workaround would be to add CAP_DAC_OVERRIDE to the service, but we do not consider weakening the packaged systemd sandbox that way to be an appropriate fix. We are instead accommodating Debian's packaged privilege model in our deployment. This appears materially equivalent to the behaviour originally reported in 2019 and described in subsequent messages on this bug. Given that this is still present on current trixie systems, could the bug be revisited and either fixed in the package or the intended filesystem/privilege constraints documented explicitly? Regards,
