This lets us avoid suid in many cases and I can't see a reason to not do it. USE=caps generally means "use libcap (or libcap-ng) to have needed privileges, rather than suid". sys-libs/libcap is an unconditional dependency of important packages anyway like sya-apps/openrc, sys-auth/elogind, and sys-apps/systemd.
There is an argument against filecaps/xattr by default, but we *do* enable those by default already and we just disable them for stages to allow portability and unpacking to exotic filesystems. Prompted by bug #961054 (which was a problem in another regard or two, but nonetheless reminded us about this). Bug: https://bugs.gentoo.org/961054 Signed-off-by: Sam James <[email protected]> --- profiles/default/linux/make.defaults | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/profiles/default/linux/make.defaults b/profiles/default/linux/make.defaults index 12dd86f25c531..53dc38b312f1b 100644 --- a/profiles/default/linux/make.defaults +++ b/profiles/default/linux/make.defaults @@ -1,4 +1,4 @@ -# Copyright 1999-2024 Gentoo Authors +# Copyright 1999-2025 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 # # System-wide defaults for the Portage system @@ -14,7 +14,7 @@ USE="crypt ipv6 ncurses nls pam readline ssl zlib" # Security ftw. -USE="${USE} seccomp" +USE="${USE} seccomp caps" # Ole Markus With <[email protected]> (2010-10-21) # These USE flags were originally inserted here because of PHP -- 2.50.1
